Configure the user account settings for a STIG-enabled system. If the
-enabled option is
yes, all other subsequent options can be specified. If the subsequent options are not specified when user account settings
-enabled is set to
yes, the default-enabled value that is specified below is used. The disabled value for these options when user account settings
-enabled is set to
no are detailed in the attributes table in
Manage user account settings.
NOTE:This command is not valid for systems that do not have STIG enabled.
Table 1. Action qualifiersThis table lists and describes the qualifiers for the user account settings command.
Qualifier
Description
-enabled
Specifies whether to enable or disable user account settings. Valid values are:
yes
no
-passwdMinSize
Specifies the minimum number of characters for a password. Value range is
8-64. If not specified, the user account setting default-enabled value is
15.
-passwdCount
Specifies the number of passwords that cannot be reused. Valid range:
3 -12. If not specified, the user account setting default enabled value is
5.
-passwdPeriod
Specifies the time period (in days) for which a password is valid before it expires. Value range is
1-180 days. If neither this value nor
-noPasswdPeriod is specified, the user account setting default-enabled value is
60.
NOTE:This setting is not applicable to local admin user accounts.
-noPasswdPeriod
Specifies that the password does not have an expiry period for local user accounts.
-maxFailedLogins
Specifies the number of consecutive failed login attempts allowed within the failed login period before the account is locked. Value range is
1-10. If neither this value nor
-noMaxFailedLogins is specified, the user account setting default value is
3.
NOTE:If this option is specified, the
-failedLoginPeriod and
-lockoutPeriod options must also be specified.
-noMaxFailedLogins
Specifies that there is no maximum limit on the number of consecutive failed login attempts.
NOTE:If this option is specified, the
-noFailedLoginPeriod and
-noLockoutPeriod options must also be specified.
-failedLoginPeriod
Specifies the time period (in seconds) during which the failed login attempts are tracked and considered, thus counting toward the maximum failed logins before lockout. Value range is
1-3600 seconds. If neither this value nor
-noFailedLoginPeriod is specified, the user account setting default-enabled value is
900.
NOTE:If this option is specified, the
-maxFailedLogins and
-lockoutPeriod options must also be specified.
If the maximum failed logins are not met during the
Failed login period, the
Maximum failed logins count resets.
-noFailedLoginPeriod
Specifies that the number of consecutive failed login attempts within a given time period is not being tracked.
NOTE:If this option is specified, the
-noMaxFailedLogins and
-noLockoutPeriod options must also be specified.
-lockoutPeriod
Specifies the time period (in seconds) for which an account is locked before the user can attempt to log in again. Value range is
1-86400 seconds. If neither this value nor
-noLockoutPeriod is specified, the user account settings default enabled value is
3600.
NOTE:If this option is specified, the
-maxFailedLogins and
-failedLoginPeriod options must also be specified.
-noLockoutPeriod
Specifies that local user accounts will not be locked due to meeting the number of
-maxFailedLogins within the
-failedLoginPeriod.
NOTE:If this option is specified, the
-noMaxFailedLogins and
-noFailedLoginPeriod options must also be specified.
-manualUnlock
Specifies that the account remains locked until manually unlocked by an administrator.
-sessionIdleTimeout
Specifies the time period (in seconds) of idle activity, after which the login session times out. The value range is:
1-3600 seconds. If neither this value nor
-noSessionIdleTimeout is specified, the user account settings default enabled value is
600.
-noSessionIdleTimeout
Specifies that the session will never time out due to being idle.
-defaultAdminLockoutEnabled
Specifies whether account lockout is enabled for admin users. Values are:
yes
no
If this value is not specified, the user account settings default enabled value is
no.
Example 1
The following command enables the user account settings with all default-enabled values set when transitioning from a disabled state:
Storage system address: 10.0.0.1
Storage system port: 443
HTTPS connection
Operation completed successfully.
Example 2
The following command disables the user account settings, which reverts the account settings back to the original values from before the settings were enabled:
uemcli -d 10.0.0.1 -u Local/joe -p MyPassword456! /user/account/settings set -enabled no
Storage system address: 10.0.0.1
Storage system port: 443
HTTPS connection
Operation completed successfully.
Data is not available for the Topic
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please select whether the article was helpful or not.
Comments cannot contain these special characters: <>()\