Cisco: monitoring users input

Based on your comments, the default sl_def_acl ACL didn't load into your configuration, for whatever reason. The behavior for the login-block feature is to use a quiet mode after certain parameters have been violated. In your case, after 3 failed attempts within 60 seconds will apply a quiet period ACL for 120 seconds. If you haven't explicitly defined a quiet mode, it will default to the below ACL.

Router#show access-lists sl_def_acl

 Extended IP access list sl_def_acl
     10 deny tcp any any eq telnet
     20 deny tcp any any eq www
     30 deny tcp any any eq 22
     40 permit ip any any

^{Default sl_def_acl ACL sample curtesy of Cisco IOS Login Enhancements (Login Block).}

Manually defining your own ACL for these parameters is ideal.

login quiet-mode access-class {acl-name | acl-number}

If you want additional information on how this function works, pop on over to the Cisco Documentation that covers this for more detail.

Run this command in config mode:

username user1 privilege 0 password NewPasswordForUser

That will change their password to NewPasswordForUser

EDIT: I should mention that it is recommended to use secret instead of password for increased security on the device. i.e.:

username user1 privilege 0 secret NewPasswordForUser

Though you can't switch from password to secret without removing the user or you'll get this error:

ERROR: Can not have both a user password and a user secret.

To make the change you'll want to remove the user:

no username user1

Then readd with a secret instead:

username user1 privilege 0 secret NewPasswordForUser