Password Configuration Options for All Users

There are several configure replication server options you can use to implement and administer Replication Server password security for all users. Replication Server uses password encryption instead of clear text when storing all passwords for new Replication Server installations.

Syntax

configure replication server
set password_param to 'parameter_value'

Password Configuration Options

`password_parameter`	Description
min_password_len	Minimum number of characters required. 0 – no minimum length. Range – 6 to 16 (default 6).
max_password_len	Maximum number of characters. Always set max_password_len to a value greater than min_password_len. Range – 13 to 30 (default 30).
password_lowercase_required	Whether lowercase characters are required. True – required. False – not required (default).
password_uppercase_required	Whether uppercase characters are required. True – required. False – not required (default).
password_numeric_required	Whether a numeric character is required. True – required. False – not required (default).
password_special_required	Whether a special character is required. True – required. False - not required (default).
simple_passwords_allowed	If you set this option (or "simple_passwords_allowed") to false, Replication Server does not allow the password to contain the user name or any values from a user password dictionary. True – allowed (default). False – not allowed. You can create the password dictionary in the RSSD in the `rs_dictionary` system table. The table does not store default values. You must create your own scripts to insert values into the table. For example: insert into rs_dictionary (words) values (“abcd”); insert into rs_dictionary (words) values (“1234”);
disallowed_prev_passwords	Number of previous passwords that cannot be reused when the user changes his or her password. 0 – previous passwords allowed. Range – 0 to 32,767 (default 0). The parameter value does not apply to a user password when the administrator is resetting the password.
password_expiration	Number of days after which the password expires. 0 – password never expires (default). Range – 0 to 32,767. You can use password_expiration with alter user and create user. If the password has expired, Replication Server locks the account and notifies the user that the password has expired. If the user does not reset his password, he or she cannot log in once disconnected until the administrator resets the password. The new password must meet all the password requirements. Passwords do not expire for any user that rs_init creates with connect source permission or the ID user. These passwords override any setting for password_expiration that you set for all users in the Replication Server. Databases, other Replication Servers, and Replication Agents use user IDs with connect source permission. Administrators set the password to not expire for any user that is created for Replication Agent or an RSI.
initial_password_expiration	Number of days after which the initial password expires. 0 – initial password never expires. Range – 0 to 32,767 (default 0). An initial password for a user is the password set by the administrator when creating the user or when resetting the user password.
max_failed_logins	Maximum number of failed login attempts Replication Server allows before locking the account. 0 – account never locked. Range – 0 to 32,767 (default 0). Replication Server locks the account according to the time interval set in password_lock_interval.
password_lock_interval	Number of minutes that an account remains locked if the user reaches the maximum number of login attempts set in max_failed_logins. 0 – account remains locked until administrator resets password. Range – 0 to 32,767 (default 0).
unused_login_expiration	Number of days after which an unused user account expires. 0 – unused account never expires. Range – 0 to 32,767 (default). Replication Server locks an account that remains unused for longer than unused_login_expiration. The administrator can reactivate the acount by resetting the password.

Examples

Enforce the minimum password length as 8 characters for all users:
```
configure replication server
set min_password_len to '8'
```
Enforce the password expiration interval as 90 days for all users:
```
configure replication server
set password_expiration to '90'
```

Usage

password_expiration is the only parameter you can use with alter user and create user. See alter user and create user in Replication Server Reference Manual > Replication Server Commands.
Password settings that you set for individual users with create user or alter user override any value that you set with configure replication server.
Use the rs_helpuser stored procedure to display the status and settings of current users.
Minimum password length:
- When the administrator or the user changes a user password, the new one must comply with any system minimum length that has been set with configure replication server.
- Setting the minimum password length does not impact the current passwords of users until users change the password.
Password expiration interval:
- When the administrator or the user changes the password of the user, Replication Server records the date. When the user logs in, Replication Server checks the login date against the password expiration setting. If there is a password expiration value set either for the user or at the system level, and Replication Server determines that the password has expired, Replication Server notifies the user to change the password and locks the account. Replication Server unlocks the account only when the user enters a new password that meets requirements. If the user disconnects before changing the password, the administrator must reset the password.
- Sybase recommends that you set the password_expiration to 0 for users that have "connect source" privilege, such as Replication Agent users, to prevent their passwords from expiring and interfering with replicating data.
When the LDAP user authentication is enabled, the password applies to both Replication Server and LDAP user accounts. Ensure that you enter a valid password that adheres to Replication Server password policy.
The password_encryption parameter is deprecated.

Permissions

You must have sa permission to configure password parameters.