accseccfg command

This command displays and configures user account security settings for the CMM, including password policies.

If command syntax is not correctly entered, or if a command fails to run, an error message is returned. See Common errors for a list of error messages that apply to all commands or accseccfg command errors for a list of error messages that are specific to the accseccfg command.

Table 1. accseccfg command.
The command table is a multi-row, four-column table where each row describes a CMM CLI command option: column one lists command function, column two provides a detailed command description, column three shows command-option syntax, and column four lists valid command targets.
Function	What it does	Command	Target (see paths in Command targets)
Display account security settings	Displays the user account security settings for the CMM. Returned values: Default security settings used (legacy, high, or custom) -alt: authentication logging timeout (in seconds) -am: user authentication method (local, ldap, localldap, or ldaplocal) -cp: complex password (on, off) -ct: CLI inactivity session timeout (in seconds) -dc: minimum number of different characters in the password (0 to 15) Note: only when -cp (complex password) is enabled. -de: default 'USERID' account password must be changed on next login (on, off) -ia: account inactivity alert time period (in days) -ici: log new login events from same user (on, off) -id: account inactivity disable time period (in days) -lf: maximum login failures (0 to 100) -lp: lockout period after maximum login failures (in minutes, 2880 maximum) -mls: maximum simultaneous user sessions -pc: password change on first access (on, off) -pe: password expiration time period (in days, 365 maximum) -pi: minimum password change interval (in hours) -rc: password reuse cycle (0 to 5) -wt: web inactivity session timeout (in minutes, none, or based on length of user session)	`accseccfg`	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set account security defaults to legacy level	Sets CMM account security to a predefined legacy set of default values. Legacy default values: -alt (authentication logging timeout): retains set value -am (user authentication method): retains set value -cp (complex password): off -ct (CLI inactivity session timeout): retains set value -dc (minimum number of different password characters): 0 -de (default account password change at next login): off -ia (account inactivity alert time period): 0 -ici (log new login events from same user): retains set value -id (account inactivity disable time): 0 -lf (maximum login failures): 20 -lp (lockout period after maximum login failures): 2 -mls (maximum simultaneous user sessions): retains set value -pc (password change on first access): off -pe (password expiration time): 0 -pi (minimum password change interval): 0 -rc (password reuse cycle): 0 -wt (web inactivity session timeout): retains set value Note Modifying any default values after setting the -legacy or -secure option changes the user account security setting indication to custom. Accounts can not be set to -legacy if the CMM chassis security level is set to secure by the security command. The user who is running the accseccfg -legacy command must have a password assigned. The -legacy option must be run alone and not in conjunction with any other accseccfg command options.	`accseccfg -legacy` This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set account security defaults to high level	Sets CMM account security to a predefined high set of default values. High default values are: -alt (authentication logging timeout): retains set value -am (user authentication method): retains set value -cp (complex password): on -ct (CLI inactivity session timeout): retains set value -dc (minimum number of different password characters): 2 -de (default account password change at next login): on -ia (account inactivity alert time period): 120 -ici (log new login events from same user): retains set value -id (account inactivity disable time): 180 -lf (maximum login failures): 20 -lp (lockout period after maximum login failures): 60 -pc (password change on first access): on -pe (password expiration time): 90 -pi (minimum password change interval): 24 -rc (password reuse cycle): 5 -wt (web inactivity session timeout): retains set value Note Modifying any default values after setting the -legacy or -secure option changes the user account security setting indication to custom. The user who is running the accseccfg -high command must have a password assigned. The -high option must be run alone and not in conjunction with any other accseccfg command options.	`accseccfg -high` This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set authentication logging timeout	Sets a custom value for the amount of time that the CMM will not log repeated authentication events (login or logout) by the same user. Note When managing the Lenovo Flex System chassis with a program that uses the Common Information Model (CIM) interface, such as the optional Lenovo XClarity Administrator, if the accseccfg -alt value is not set to none, the CIM interface uses a minimum authentication logging timeout of 3600 seconds whenever the accseccfg -alt value is set to less than 3600 seconds. Other CMM functions use the configured accseccfg -alt value.	`accseccfg -alt` timeout where timeout is 0, 5, 30, 60, 300, 600, 1800, 3600, 43200, or 86400 seconds. If a value of none is entered, the initial and any repeated authentication events will never be logged. This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set user authentication method	Sets a custom value for CMM user authentication method. Important If the authentication method is set to ldap (ldap only), you might not be able to log in to the CMM if the LDAP server is unreachable or if login credentials are not correctly configured.	`accseccfg -am` method where method is `local` `ldap` `localldap` `ldaplocal` This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Enable / disable complex password	Enables or disables the complex password for CMM user authentication. Note -cp must be on to set the CMM chassis security level to secure with the security command. -cp must be on to configure the -dc (minimum number of password character types) command option. Setting -cp to off will set -dc to 0. The user that is running the accseccfg -cp command must have a password assigned.	`accseccfg -cp` state where state is `on` or `off` . This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set CLI inactivity timeout	Sets the custom value for CMM CLI inactivity session timeout.	`accseccfg -ct` timeout where timeout is from 0 to 4,294,967,295 seconds, inclusive. This command can only be run by users who have the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set minimum number of different characters for password	Sets custom value for the minimum number of different characters to be used in a CMM password. Note The minimum number of different characters applies only when complex passwords are enabled (-cp on). Setting -cp to off will set -dc to 0. The -rc command option must be non-zero to configure the minimum number of password character types. Setting -rc to zero will set -dc to 0. If a -dc value is not set when setting -rc command option to a non-zero value, -dc will be set to a default value of 2.	`accseccfg -dc` number where number is from 0 to 15, inclusive. This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Enable / disable default administration password expiration	Enables or disables the default administration password expiration for the CMM. If enabled, the manufacturing default 'USERID' account password must be changed at the next login. Note -de must be on to set the CMM chassis security level to secure with the security command.	`accseccfg -de` state where state is `on` or `off` . This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set account inactivity alert time	Sets custom value for CMM account inactivity alert time. Note The accseccfg -ia value must be less than the accseccfg -id value.	`accseccfg -ia` time where time is from 0 to 365 days, inclusive. This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set state for logging of login events from same IP address	Enables or disables logging of new login events from the same user from the same IP address. Note This value applies only if the value set by the -alt command option is set to something other than 0 or none. When managing the Lenovo Flex System chassis with a program that uses the Common Information Model (CIM) interface, such as the optional Lenovo XClarity Administrator, login event logging is treated as disabled by the CIM interface, regardless of the accseccfg -ici setting. Other CMM functions use the configured accseccfg -ici value.	`accseccfg -ici` state where state is `on` or `off` . This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set account inactivity disable time	Sets the custom value for CMM account inactivity disable time. Note The accseccfg -id value must be greater than the accseccfg -ia value.	`accseccfg -id` time where time is from 0 to 365 days, inclusive. This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set maximum number of login failures	Sets the custom value for the maximum number of login failures before the CMM locks out a user.	`accseccfg -lf` number where number is from 0 to 100, inclusive. This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set lockout period	Sets the custom value for CMM account lockout period, used when the maximum number of login failures is exceeded.	`accseccfg -lp` time where time is from 0 to 2880 minutes, inclusive. This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set maximum LDAP sessions for user	Sets the custom value for the maximum number of simultaneous login sessions allowed for a single LDAP user	`accseccfg -mls` max_sessions where max_sessions is from 0 to 20, inclusive. This command can only be run by users who have the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Enable / disable password change at first login	Enables or disables the mandatory password change at first CMM login. When on, new users must change their password the first time they log in. If a user password is changed by a system administrator, this user must change their password the next time they log in. Note accseccfg -pc is set to on automatically when accseccfg is set to -high accseccfg -pc must be on to set the CMM chassis security level to secure with the security command.	`accseccfg -pc` state where state is `on` or `off` . This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set password expiration time	Sets custom value for the CMM password expiration time.	`accseccfg -pe` time where time is from 0 to 365 days, inclusive. This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set password minimum change interval	Sets custom value for the minimum amount of time between CMM password changes. Note If the minimum password change interval is greater than 0, it must be less than password expiration period.	`accseccfg -pi` time where time is from 0 to 1440 hours, inclusive, and less than password expiration period when that period is greater than 0. This command can only be run by users who have the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set password reuse cycle	Sets custom value for the CMM password reuse cycle. This setting determines how many times a password must be changed before being reused. Note -rc must be non-zero to configure the -dc (minimum number of password character types) command option. Setting -rc to zero will set -dc to 0. If a -dc value is not set when setting -rc command option to a non-zero value, -dc will be set to a default value of 2.	`accseccfg -rc` number_reuses where number_reuses is from 0 to 5, inclusive. This command can only be run by users who have the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.
Set web interface inactivity timeout	Sets custom value for CMM web interface inactivity session timeout.	`accseccfg -wt` timeout where timeout is 1, 5, 10, 15, or 20 minutes, `none` (no timeout), or `user` (user picks timeout each time they log in to the web interface). This command can only be run by users who have one or more of the following command authorities: Supervisor Chassis configuration See Commands and user authority for additional information.	Primary CMM: mm[p] mm[P] mm[x] where x is the primary CMM bay number.

Example:

To set CMM account security to use the legacy level defaults, while the Lenovo Flex System chassis is set as the persistent command environment, at the system> prompt, type

accseccfg -legacy -T mm[p]

To display the account security settings for the CMM, while the Lenovo Flex System chassis is set as the persistent command environment, at the system> prompt, type

accseccfg -T mm[p]

To disable the authentication logging timeout for the CMM, while the Lenovo Flex System chassis is set as the persistent command environment, at the system> prompt, type

accseccfg -alt none -T mm[p]

The following example shows the information that is returned from these commands:

system> accseccfg -legacy -T mm[p]
OK
system> accseccfg -T mm[p]
-legacy
-alt 300
-am local
-cp off
-ct 0
-dc 0
-de off
-ia 0
-ici off
-id 0
-lf 20
-lp 2
-mls 0
-pc off
-pe 0
-pi 0
-rc 0
-wt user
<span className="ph">system> accseccfg -alt none -T mm[p]
OK</span>
system>

Give documentation feedback