×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

TACACS+ password aging does not work with SSH on a Cisco router with Cisco IOS 12.0

Document

Wed, 11/18/2009 - 18:23
Jun 22nd, 2009
User Badges:
  • Gold, 750 points or more

Core issue

Secure Shell (SSH) does not support the password change feature before expiry for users that employ TACACS+ authentication. The feature does work for expired passwords because it can trigger a password change sequence at that point.

Use Telnet if a password must be changed before expiry.


Resolution


The password change feature (before expiry) for TACACS+ users is incorporated in SSHv2. In SSHv2, SSH_MSG_USERAUTH_PASSWD_CHANGEREQ permits this functionality.

To resolve this issue, verify the version of the Cisco IOS image running on the Cisco IOS device. SSHv2 is integrated in these Cisco IOS images:


  • 12.2(25)S06        
  • 12.2(18)SXE        
  • 12.1(22)EA03        
  • 12.2(25)SEB        
  • 12.2(25)SEA        
  • 12.2(27.07)S        
  • 12.3(10.01)T and onwards        

For more information, refer to Secure Shell Version 2 support in Cisco IOS Software Release 12.4


Problem Type


Password recovery

Troubleshoot software feature


Product Family


Routers

Loading.

Actions

This Document

Related Content