Password Complexity- Keyboard Pattern Prevention

ReleaseNotesforCiscoCatalyst1200and1300SeriesSwitches-Firmware
Version 4.1.4.1

September 2024
This Release Note describes the recommended practices and known issues that apply to software version
4.1.4.1 for the Cisco Catalyst 1200 and 1300 Series Switches.

What's New
This section details new features and modifications added to Version 4.1.4.1 compared to previous releases.

Password Complexity- Keyboard Pattern Prevention
• Anewpassword complexity setting called Keyboard pattern prevention was added in this version.
• Whenenabled, the password configured by the user can’t include more than three consecutive letters or
numbers keys on the QWERTY keyboard.
• Thisfeature can be enabledor disabled using the “passwords complexitykeyboard-pattern” CLI command.
By default, this feature is disabled. In the current version there isn’t GUI control for this setting.
• Thefeature applies to the passwords configured via one of the following commands “username” (Global
Configuration modecommand)“enablepassword”(GlobalConfigurationmodecommand)and“password”
(Line Configuration mode command)

Masked Secret
• From this version and on the user has the option to type in a password as a masked secret, instead of a
cleartext password. The masked secret is provided by the user following a prompt displayed on the screen.
The masked password needs to be confirmed by the user, as follows:
switch(config)#username example privilege 15 masked-secret
Enter secret:
secret: Confirm secret:
• This ability was added to the following commands “username” (Global Configuration mode command)
and “enable password” (Global Configuration mode command)
• The command including the password is saved to the configuration in the same format as a command
entered in cleartext

Security Syslog
Security-related messages were enhanced to include the following:
• The syslog messages which indicate firmware upgrade success or failure, includes the following
information:
• The management interface from which the firmware operation was initiated (Console, telnet, SSH,
HTTP, or HTTPS).
• The username of the management session that initiated the firmware operation.
• The IP address of the management session that initiated the firmware operation.
• Asyslog message, which includes the information detailed in the previous item, is generated when one
of the following management interfaces are enabled or disabled: SSH; Telnet; HTTP/HTTPS or SNMP.

Log File Exceed Threshold
• In this version the user can configure an alarm threshold for the logging file (file messages stored to the
flash).
• Oncethis threshold is exceeded a syslog message is generated indicating the threshold has been crossed.
• The command to set this threshold is “logging file threshold percent” where percent is a number 1–99.
By default, a threshold isn’t defined- which means the syslog message won’t be generated