AAA

An accounting entry was not deleted.

An authentication entry was not deleted.

An authorization entry was not deleted.

The local account was deleted.

• The local-user user-name state block command was executed.
• The lock function was enabled for the local account, and the number of consecutive times that a user entered incorrect passwords reached the maximum.

• The local-user user-name state active command was executed.
• The lock function was enabled for the local account, and the number of consecutive times that a user entered incorrect passwords reached the maximum. The local account was locked. The local account was automatically unlocked when the lock duration reached.

The password of the local account was changed.

• The user has entered incorrect old passwords for specified times within the specified retry interval, and therefore the user account is locked. During the locking period, the user cannot change the password.

• The administrator has set the state of this local user to block.

• The user account was locked. When the locking time expires, the user account is unlocked automatically.

• The administrator has set the state of the local account to active.

A user changes the password of his own or of another user through the Web NMS.

The validity period of the local account's password has expired. The validity period is set by using the password expire command.

The current time is not included in the block period configured by state block time-range, so the domain status is changed from blocked to activated.

The current time is included in the block period configured by state block time-range, so the domain status is changed from activated to blocked.

The current time is not in the expiry date configured by local-user expire-date, so the account becomes invalid.

The current time is within the access permission period configured by local-user time-range. The user is allowed to be authenticated through this account.

The current time is in the expiry date configured by local-user expire-date, so the account becomes valid.

The current time is not in the access permission period configured by local-user time-range, so the account becomes invalid.

The device asks a user to change the password when a user logs in to the device using the default password or initial password for the first time after the local administrator password policy is configured, or a user logs in to the device using an expired password or a password about to expire. If any of the following errors occur in password changing process, the log is recorded:

• The new password does not meet the length requirement.
• The new password is the same as a historical password.
• The original password entered is incorrect.
• The new password does not meet complexity requirement (the password must contain at least two types of uppercase and lowercase letters, numerals, and special characters).
• The new password is the same as the user name or the user name in reverse order.
• The new password is the same as the default password of local users on the device.
• The new password contains spaces.

After the protocol replay function is enabled, users use RADIUS authentication.

The remote AAA authentication account locking function has been enabled using the access-user remote authen-fail or administrator remote authen-fail command. When a user using remote AAA authentication (RADIUS or HWTACACS) entered incorrect user name or password consecutively within the interval, the user was locked.

• Run the remote-user authen-fail unblock command to unlock the remote account.
• When the locking time of an account exceeds the locking time set by access-user remote authen-fail or administrator remote authen-fail command, the account is automatically unlocked.

After the HWTACACS user logs in to the device, the execution of the hwtacacs-user change-password hwtacacs-server template-name command succeeds.

After the HWTACACS user logs in to the device, user attributes fail to be changed.

An HWTACACS password modification entry was not deleted.