A complex password is recommended to prevent access to a firewall by an unauthorized user. This article provides information about configuring password complexity parameters on an SRX.

A type of password attack known as a Brute Force attack, for example, constantly tries random usernames and passwords to acquire access to the device. The time taken by a Brute Force mechanism to guess the correct password is directly proportional to the complexity of the password. Therefore, a complex password is recommended.

The Junos OS provides multiple options for setting the complexity of passwords.

Creating a Complex Password

Set the following options according to your requirements and commit the changes:

root@SRX# set system login password minimum-length 10
root@SRX# set system login password maximum-length 22
root@SRX# set system login password change-type set-transitions
root@SRX# set system login password minimum-changes 4
root@SRX# set system login password minimum-reuse 3
root@SRX# set system login password maximum-lifetime 90
​​​​​​

root@SRX# set system login password change-type ?
Possible completions:
character-sets   Count number of character type
set-transitions  Count changes in character type

If the change-type statement is configured for the character-set option, the minimum-changes value must be 5 or less because Junos OS supports only five character sets (lowercase letters, uppercase letters, numbers, punctuation, and the following special characters: ! @ # $ % ^ & * , +< > : ;).

minimum-changes : Specifies how many character sets or character set changes are required for the password. If you do not use the minimum-changes statement, character sets are not checked for Junos OS.

minimum-reuse : Specify the number of old passwords which should not match the new password. If you do not use the minimum-reuse statement, password reuse are not checked for Junos OS.

maximum-lifetime : Specify the maximum duration of a password in days, where the password expires after the maximum duration is reached. By default, Junos OS passwords have no maximum lifetime. For more detail, please check password (Login) document.

Notes

• Changes to password requirements do not take effect until the configuration is committed.
• When requirements change, only newly created, plain-text passwords are checked; existing passwords are not checked against the new requirements.
• The default configuration for Junos OS plain-text passwords is below:

[edit system login]
root@SRX# show
passwords {
     change-type character-sets;
     format md5;
     minimum-changes 1;
     minimum-length 6;
}

Verifying Password Complexity

Use the set system root-authentication plain-text-password command to check that your password meets the security requirements.

As per the above configuration example, a password should have a minimum of 10 characters, a maximum of 22 characters, and a minimum of 4 changes between character sets.

The examples below show the output of a few set system root-authentication plain-text-password commands.

7 characters only

root@SRX# set system root-authentication plain-text-password
New password: JuN!p3R <7 characters only>
error: minimum password length is 10
 

More than 22 characters

root@SRX# set system root-authentication plain-text-password
New password: JuN!p3RJuN!p3RJuN!p3RJuN!p3R <more than 22 characters>
error: maximum password length is 22
 

Only 1 transition from upper case to digit (R-1)

root@SRX# set system root-authentication plain-text-password
New password: JUNIPER123 <only 1 transition from upper case to digit (R-1)>
error: require 5 changes of case, digits or punctuation

The new password must be different from last 3 passwords

The last 3 passwords are password1, password2 and password3

root@srx# set system root-authentication plain-text-password
New password: password1 <same as the last 3 passwords>
Retype new password: password1
error: New password should be different from last 3 passwords; aborting

Password meets all the requirements, prompts to retype

<Password meets all the requirements, prompts to retype>
root@SRX# set system root-authentication plain-text-password
New password: JuN!p3R123 <Password meets all the requirements, prompts to retype>
Retype new password:

This password has 10 characters and the following transitions: J-u, u-N, N-!, !-p, p-3, 3-R, R-1. It meets all the configured requirements. After the password is typed and Enter is pressed, you are prompted to re-enter the password as it appears.

2020-03-26: Article reviewed for accuracy; it is valid and accurate
2024-09-19: added minimum-reuse and maximum-lifetime statement

• Example: Configuring System Retry Options
• Configuring Password Retry Limits for Telnet and SSH Access
• password (Login)