- Table of Contents
-
- 01-Fundamentals Configuration Guide
- 00-Preface
- 01-CLI configuration
- 02-RBAC configuration
- 03-Login management configuration
- 04-FTP and TFTP configuration
- 05-File system management configuration
- 06-Configuration file management configuration
- 07-Software upgrade configuration
- 08-Automatic configuration
- 09-Preprovisioning feature configuration
- Related Documents
-
Title | Size | Download |
---|---|---|
03-Login management configuration | 257.37 KB |
Contents
Using the console port for the first device access
Restrictions and guidelines: CLI login configuration
Console login configuration tasks at a glance
Configuring console login authentication
Configuring common console login settings
Configuring the device as a Telnet server
Using the device to log in to a Telnet server
Configuring the device as an SSH server
Using the device to log in to an SSH server
Verifying and maintaining CLI login
Displaying user line configuration and operating status
Sending messages to user lines
Displaying Telnet client settings
Controlling user access to the device
About login user access control
Controlling Telnet and SSH logins
Example: Controlling Telnet login
Configuring command authorization
Example: Configuring command authorization
Configuring command accounting
Example: Configuring command accounting
Login overview
The device supports the following types of login methods:
· CLI login—At the CLI, you can enter text commands to configure and manage the device.
To log in to the CLI, you can use one of the following methods:
¡ Connect to the console port.
¡ Use Telnet.
¡ Use SSH.
The first time you access the device, you can only log in to the CLI through the console port unless the device is automatically configured at startup. After login, you can change console login parameters or configure other access methods.
Using the console port for the first device access
About this task
Console login is the fundamental login method.
Prerequisites
To log in through the console port, prepare a console terminal, for example, a PC. Make sure the console terminal has a terminal emulation program, such as HyperTerminal or PuTTY. For information about how to use terminal emulation programs, see the programs' user guides.
Procedure
1. Turn off the PC.
The serial ports on PCs do not support hot swapping. Before connecting a cable to or disconnecting a cable from a serial port on a PC, you must turn off the PC.
2. Find the console cable shipped with the device and connect the DB-9 female connector of the console cable to the serial port of the PC.
3. Identify the console port of the device carefully and connect the RJ-45 connector of the console cable to the console port.
IMPORTANT: To connect a PC to an operating device, first connect the PC end. To disconnect a PC from an operating device, first disconnect the device end. |
Figure 1 Connecting a terminal to the console port
4. Turn on the PC.
5. On the PC, launch the terminal emulation program, and create a connection that uses the serial port connected to the device. Set the port properties so the port properties match the following console port default settings:
¡ Bits per second—9600 bps.
¡ Flow control—None.
¡ Parity—None.
¡ Stop bits—1.
¡ Data bits—8.
6. Power on the device and press Enter as prompted.
The user view prompt appears. You can enter commands to configure or manage the device. To get help, enter a question mark (?).
Configuring CLI login
About CLI login
The device uses user lines (also called user interfaces) to manage CLI sessions and monitor user behavior. For a user line, you can configure access control settings, including the login authentication method and user roles.
User lines
User line types
The device supports the types of user lines listed in Table 1. Different user lines require different login methods.
Table 1 CLI login method and user line matrix
User line |
Login method |
AUX line |
Console port. |
Virtual type terminal (VTY) line |
Telnet or SSH. |
User line numbering
A user line has an absolute number and a relative number.
An absolute number uniquely identifies a user line among all user lines. The user lines are numbered starting from 0 and incrementing by 1, in the sequence of AUX and VTY lines. You can use the display line command without any parameters to view supported user lines and their absolute numbers.
A relative number uniquely identifies a user line among all user lines of the same type. The number format is user line type + number. All types of user lines are numbered starting from 0 and incrementing by 1. For example, the first VTY line is VTY 0.
User line assignment
The device assigns user lines to CLI login users depending on their login methods, as shown in Table 1. When a user logs in, the device checks the idle user lines for the login method, and assigns the lowest numbered user line to the user. For example, if VTY 0 and VTY 3 are idle when a user Telnets to the device, the device assigns VTY 0 to the user.
Each user line can be assigned only to one user at a time. If no user line is available, a CLI login attempt will be rejected.
Login authentication modes
You can configure login authentication to prevent illegal access to the device CLI.
The device supports the following login authentication modes:
· None—Disables authentication. This mode allows access without authentication and is insecure.
· Password—Requires password authentication. A user must provide the correct password at login.
· Scheme—Uses the AAA module to provide local or remote login authentication. A user must provide the correct username and password at login.
Different login authentication modes require different user line configurations, as shown in Table 2.
Table 2 Configuration required for different login authentication modes
Authentication mode |
Configuration tasks |
|
None |
Set the authentication mode to none. |
|
Password |
1. Set the authentication mode to password. 2. Set a password. |
|
Scheme |
3. Set the authentication mode to scheme. 4. Configure login authentication methods in ISP domain view. For more information, see AAA in User Access and Authentication Configuration Guide. |
|
User roles
A user is assigned user roles at login. The user roles control the commands available for the user. For more information about user roles, see "Configuring RBAC."
The device assigns user roles based on the login authentication mode and user type.
· In none or password authentication mode, the device assigns the user roles specified for the user line.
· In scheme authentication mode, the device uses the following rules to assign user roles:
¡ For an SSH login user who uses publickey or password-publickey authentication, the device assigns the user roles specified for the local device management user with the same name.
¡ For other users, the device assigns user roles according to the user role configuration of the AAA module. If the AAA server does not assign any user roles and the default user role feature is disabled, a remote AAA authentication user cannot log in.
Restrictions and guidelines: CLI login configuration
For commands that are available in both user line view and user line class view, the following rules apply:
· A setting in user line view applies only to the user line. A setting in user line class view applies to all user lines of the class.
· A non-default setting in either view takes precedence over the default setting in the other view. A non-default setting in user line view takes precedence over the non-default setting in user line class view.
· A setting in user line class view takes effect only on users who log in after the setting is made. It does not affect users who are already online when the setting is made.
Configuring console login
About console and AUX login
You can connect a terminal to the console port of the device to log in and manage the device, as shown in Figure 2. For information about the login procedure, see "Using the console port for the first device access."
Figure 2 Logging in through the console port
By default, console login is enabled and does not require authentication. The user role is network-admin for a console user. To improve device security, configure password or scheme authentication for console login immediately after you log in to the device for the first time.
Restrictions and guidelines
A console login configuration change takes effect only on users who log in after the change is made. It does not affect users who are already online when the change is made.
Console login configuration tasks at a glance
To configure console login, perform the following tasks:
1. Configuring console login authentication
¡ Disabling authentication for console login
¡ Configuring password authentication for console login
¡ Configuring scheme authentication for console login
2. (Optional.) Configuring common console login settings
Configuring console login authentication
Disabling authentication for console login
1. Enter system view.
system-view
2. Enter AUX line view or class view.
¡ Enter AUX line view.
line aux first-number [ last-number ]
¡ Enter AUX line class view.
line class aux
3. Disable authentication.
authentication-mode none
By default, authentication is disabled for console login.
CAUTION: When authentication is disabled, users can log in to the device through the line or line class without authentication. For security purpose, disable authentication with caution. |
4. Assign a user role.
user-role role-name
By default, a console user is assigned the network-admin user role.
Configuring password authentication for console login
1. Enter system view.
system-view
2. Enter AUX line view or class view.
¡ Enter AUX line view.
line aux first-number [ last-number ]
¡ Enter AUX class view.
line class aux
3. Enable password authentication.
authentication-mode password
By default, authentication is disabled for console login.
CAUTION: When you enable password authentication, you must also configure an authentication password for the line or line class. If no authentication password is configured, you cannot log in to the device through the line or line class at the next time. |
4. Set a password.
set authentication password { hash | simple } password
By default, no password is set.
5. Assign a user role.
user-role role-name
By default, a console user is assigned the network-admin user role.
Configuring scheme authentication for console login
1. Enter system view.
system-view
2. Enter AUX line view or class view.
¡ Enter AUX line view.
line aux first-number [ last-number ]
¡ Enter AUX line class view.
line class aux
3. Enable scheme authentication.
authentication-mode scheme
By default, authentication is disabled for console login.
CAUTION: When you enable scheme authentication, make sure an authentication user account is available. If no authentication user account is available, you cannot log in to the device through the line or line class at the next time. |
4. Configure user authentication parameters in ISP domain view.
To use local authentication, configure a local user and set the relevant attributes. To use remote authentication, configure a RADIUS, LDAP, or HWTACACS scheme. For more information, see AAA in User Access and Authentication Configuration Guide.
Configuring common console login settings
Restrictions and guidelines
Some common console login settings take effect immediately and can interrupt the current session. Use a login method different from console login to log in to the device before you change console login settings.
After you change console login settings, adjust the settings on the configuration terminal accordingly for a successful login.
Procedure
1. Enter system view.
system-view
2. Enter AUX line view or class view.
¡ Enter AUX line view.
line aux first-number [ last-number ]
¡ Enter AUX line class view.
line class aux
3. Configure transmission parameters.
¡ Set the transmission rate.
speed speed-value
By default, the transmission rate is 9600 bps.
This command is not available in user line class view.
¡ Specify the parity mode.
parity { even | mark | none | odd | space }
By default, a user line does not use parity.
This command is not available in user line class view.
¡ Configure flow control.
flow-control { hardware | none | software }
By default, the device does not perform flow control.
This command is not available in user line class view.
¡ Specify the number of data bits for a character.
databits { 5 | 6 | 7 | 8 }
The default is 8.
This command is not available in user line class view.
Parameter |
Description |
7 |
Uses standard ASCII characters. |
8 |
Uses extended ASCII characters. |
¡ Specify the number of stop bits for a character.
stopbits { 1 | 1.5 | 2 }
The default is 1.
Stop bits indicate the end of a character. The more the stop bits, the slower the transmission.
This command is not available in user line class view.
4. Configure terminal attributes.
¡ Enable the terminal service.
shell
Be default, the terminal service is enabled on all user lines.
The undo shell command is not available in AUX line view.
¡ Specify the terminal display type.
terminal type { ansi | vt100 }
By default, the terminal display type is ANSI.
The device supports ANSI and VT100 terminal display types. As a best practice, specify VT100 type on both the device and the configuration terminal. You can also specify the ANSI type for both sides, but a display problem might occur if a command line has more than 80 characters.
¡ Set the maximum number of lines of command output to send to the terminal at a time.
screen-length screen-length
By default, the device sends a maximum of 24 lines to the terminal at a time.
To disable pausing between screens of output, set the value to 0.
¡ Set the size for the command history buffer.
history-command max-size value
By default, the buffer size is 10. The buffer for a user line can save a maximum of 10 history commands.
¡ Set the CLI connection idle-timeout timer.
idle-timeout minutes [ seconds ]
By default, the CLI connection idle-timeout timer is 10 minutes.
If no interaction occurs between the device and the user within the idle-timeout interval, the system automatically terminates the user connection on the user line.
If you set the timeout timer to 0, the connection will not be aged out.
5. Specify the command to be automatically executed for login users on the lines.
auto-execute command command
By default, no command is specified for auto execution.
CAUTION: Use this command with caution. If this command is used on a user line, users that log in to the device through this user line might fail to configure the system. |
The device will automatically execute the specified command when a user logs in through the user line, and close the user connection after the command is executed.
This command is not available in AUX line view or AUX line class view.
6. Configure shortcut keys.
¡ Specify the terminal session activation key.
activation-key character
By default, pressing Enter starts the terminal session.
¡ Specify the escape key.
escape-key { character | default }
By default, pressing Ctrl+C terminates a command.
¡ Set the user line locking key.
lock-key key-string
By default, no user line locking key is set.
Configuring Telnet login
About Telnet login
The device can act as a Telnet server to allow Telnet login, or as a Telnet client to Telnet to other devices.
Restrictions and guidelines
A Telnet login configuration change takes effect only on users who log in after the change is made. It does not affect users who are already online when the change is made.
Configuring the device as a Telnet server
Telnet server configuration tasks at a glance
To configure the device as a Telnet server, perform the following tasks:
2. Configuring Telnet login authentication
¡ Disabling authentication for Telnet login
¡ Configuring password authentication for Telnet login
¡ Configuring scheme authentication for Telnet login
3. (Optional.) Configuring common Telnet server settings
4. (Optional.) Configuring common VTY line settings
Enabling the Telnet server
1. Enter system view.
system-view
2. Enable the Telnet server.
telnet server enable
By default, the Telnet server is disabled.
Disabling authentication for Telnet login
1. Enter system view.
system-view
2. Enter VTY line view or class view.
¡ Enter VTY line view.
line vty first-number [ last-number ]
¡ Enter VTY line class view.
line class vty
3. Disable authentication.
authentication-mode none
By default, password authentication is enabled for Telnet login.
CAUTION: When authentication is disabled, users can log in to the device through the line or line class without authentication. For security purpose, disable authentication with caution. |
In VTY line view, this command is associated with the protocol inbound command. If one command has a non-default setting in VTY line view, the other command uses its setting in VTY line view, regardless of its setting in VTY line class view.
4. (Optional.) Assign a user role.
user-role role-name
By default, a VTY line user is assigned the network-operator user role.
Configuring password authentication for Telnet login
1. Enter system view.
system-view
2. Enter VTY line view or class view.
¡ Enter VTY line view.
line vty first-number [ last-number ]
¡ Enter VTY line class view.
line class vty
3. Enable password authentication.
authentication-mode password
By default, password authentication is enabled for Telnet login.
CAUTION: When you enable password authentication, you must also configure an authentication password for the line or line class. If no authentication password is configured, you cannot log in to the device through the line or line class at the next time. |
In VTY line view, this command is associated with the protocol inbound command. If one command has a non-default setting in VTY line view, the other command uses its setting in VTY line view, regardless of its setting in VTY line class view.
4. Set a password.
set authentication password { hash | simple } password
By default, no password is set.
5. (Optional.) Assign a user role.
user-role role-name
By default, a VTY line user is assigned the network-operator user role.
Configuring scheme authentication for Telnet login
1. Enter system view.
system-view
2. Enter VTY line view or class view.
¡ Enter VTY line view.
line vty first-number [ last-number ]
¡ Enter VTY line class view.
line class vty
3. Enable scheme authentication.
authentication-mode scheme
By default, password authentication is enabled for Telnet login.
CAUTION: When you enable scheme authentication, make sure an authentication user account is available. If no authentication user account is available, you cannot log in to the device through the line or line class at the next time. |
In VTY line view, this command is associated with the protocol inbound command. If one command has a non-default setting in VTY line view, the other command uses its setting in VTY line view, regardless of its setting in VTY line class view.
4. Configure user authentication parameters in ISP domain view.
To use local authentication, configure a local user and set the relevant attributes.
To use remote authentication, configure a RADIUS, LDAP, or HWTACACS scheme. For more information, see AAA in User Access and Authentication Configuration Guide.
Configuring common Telnet server settings
1. Enter system view.
system-view
2. Set the DSCP value for outgoing Telnet packets.
IPv4:
telnet server dscp dscp-value
IPv6:
telnet server ipv6 dscp dscp-value
By default, the DSCP value is 48.
3. Specify the Telnet service port number.
IPv4:
telnet server port port-number
IPv6:
telnet server ipv6 port port-number
By default, the Telnet service port number is 23.
4. Set the maximum number of concurrent Telnet users.
aaa session-limit telnet max-sessions
By default, the maximum number of concurrent Telnet users is 32.
Changing this setting does not affect users who are currently online. If the new limit is less than the number of online Telnet users, no additional users can Telnet in until the number drops below the new limit.
For more information about this command, see User Access and Authentication Command Reference.
Configuring common VTY line settings
1. Enter system view.
system-view
2. Enter VTY line view or class view.
¡ Enter VTY line view.
line vty first-number [ last-number ]
¡ Enter VTY line class view.
line class vty
3. Configure VTY terminal attributes.
¡ Enable the terminal service.
shell
By default, the terminal service is enabled on all user lines.
¡ Specify the terminal display type.
terminal type { ansi | vt100 }
By default, the terminal display type is ANSI.
¡ Set the maximum number of lines of command output to send to the terminal at a time.
screen-length screen-length
By default, the device sends a maximum of 24 lines to the terminal at a time.
To disable pausing between screens of output, set the value to 0.
¡ Set the size for the command history buffer.
history-command max-size value
By default, the buffer size is 10. The buffer for a user line can save a maximum of 10 history commands.
¡ Set the CLI connection idle-timeout timer.
idle-timeout minutes [ seconds ]
By default, the CLI connection idle-timeout timer is 10 minutes.
If no interaction occurs between the device and the user within the idle-timeout interval, the system automatically terminates the user connection on the user line.
If you set the timeout timer to 0, the connection will not be aged out.
4. Specify the supported protocols.
protocol inbound { all | ssh | telnet }
By default, Telnet and SSH are supported.
A protocol change takes effect only on users who log in after the setting is made. It does not affect users who are already online when the setting is made.
In VTY line view, this command is associated with the authentication-mode command. If one command has a non-default setting in VTY line view, the other command uses its setting in VTY line view, regardless of its setting in VTY line class view.
5. Specify the command to be automatically executed for login users on the user lines.
auto-execute command command
By default, no command is specified for auto execution.
IMPORTANT: Before you configure this command and save the configuration, make sure you can access the CLI to modify the configuration through other VTY lines or AUX lines. |
For a VTY line, you can specify a command that is to be automatically executed when a user logs in. After executing the specified command, the system automatically disconnects the Telnet session.
6. Configure shortcut keys.
¡ Specify the shortcut key for terminating a task.
escape-key { character | default }
The default setting is Ctrl+C.
¡ Set the user line locking key.
lock-key key-string
By default, no user line locking key is set.
Using the device to log in to a Telnet server
About this task
You can use the device as a Telnet client to log in to a Telnet server.
Figure 3 Telnetting from the device to a Telnet server
Prerequisites
Assign an IP address to the device and obtain the IP address of the Telnet server. If the device resides on a different subnet than the Telnet server, make sure the device and the Telnet server can reach each other.
Procedure
1. Enter system view.
system-view
2. (Optional.) Specify the source IPv4 address or source interface for outgoing Telnet packets.
telnet client source { interface interface-type interface-number | ip ip-address }
By default, no source IPv4 address or source interface is specified. The device uses the primary IPv4 address of the output interface as the source address for outgoing Telnet packets.
3. Return to user view.
quit
4. Use the device to log in to a Telnet server.
IPv4:
telnet remote-host [ service-port ] [ vpn-instance vpn-instance-name ] [ source { interface interface-type interface-number | ip ip-address } | dscp dscp-value ] *
IPv6:
telnet ipv6 remote-host [ -i interface-type interface-number ] [ port-number ] [ vpn-instance vpn-instance-name ] [ source { interface interface-type interface-number | ipv6 ipv6-address } | dscp dscp-value ] *
Configuring SSH login
About SSH login
SSH offers a secure remote login method. By providing encryption and strong authentication, it protects devices against attacks such as IP spoofing and plaintext password interception. For more information, see SSH in Security Configuration Guide.
The device can act as an SSH server to allow Telnet login, or as an SSH client to log in to an SSH server.
Configuring the device as an SSH server
About this task
This section provides the SSH server configuration procedure used when the SSH client authentication method is password. For more information about SSH and publickey authentication configuration, see SSH in Security Configuration Guide.
Procedure
1. Enter system view.
system-view
2. Create local key pairs.
public-key local create { dsa | ecdsa [ secp192r1 | secp256r1 | secp384r1 | secp521r1 ] | rsa } [ name key-name ]
3. Enable the SSH server.
ssh server enable
By default, the SSH server is disabled.
4. (Optional.) Create an SSH user and specify the authentication mode.
ssh user username service-type stelnet authentication-type password
5. Enter VTY line view or class view.
¡ Enter VTY line view.
line vty first-number [ last-number ]
¡ Enter VTY line class view.
line class vty
6. Enable scheme authentication.
authentication-mode scheme
By default, password authentication is enabled for VTY lines.
In VTY line view, this command is associated with the protocol inbound command. If one command has a non-default setting in VTY line view, the other command uses its setting in VTY line view, regardless of its setting in VTY line class view.
CAUTION: When you enable scheme authentication, make sure an authentication user account is available. If no authentication user account is available, you cannot log in to the device through the line or line class at the next time. |
7. (Optional.) Specify the protocols for the user lines to support.
protocol inbound { all | ssh | telnet }
By default, Telnet and SSH are supported.
A protocol change takes effect only on users who log in after the setting is made. It does not affect users who are already online when the setting is made.
In VTY line view, this command is associated with the authentication-mode command. If one command has a non-default setting in VTY line view, the other command uses its setting in VTY line view, regardless of its setting in VTY line class view.
8. (Optional.) Set the maximum number of concurrent SSH users.
aaa session-limit ssh max-sessions
By default, the maximum number of concurrent SSH users is 32.
Changing this setting does not affect users who are currently online. If the new limit is less than the number of online SSH users, no additional SSH users can log in until the number drops below the new limit.
For more information about this command, see User Access and Authentication Command Reference.
9. (Optional.) Configure common settings for VTY lines:
a. Return to system view.
quit
b. Configure common settings for VTY lines.
See "Configuring common VTY line settings."
Using the device to log in to an SSH server
About this task
You can use the device as an SSH client to log in to an SSH server.
Figure 4 Logging in to an SSH server from the device
Prerequisites
Assign an IP address to the device and obtain the IP address of the SSH server. If the device resides on a different subnet than the SSH server, make sure the device and the SSH server can reach each other.
Procedure
To use the device to log in to an SSH server, execute one of the following commands in user view:
IPv4:
ssh2 server
IPv6:
ssh2 ipv6 server
To work with the SSH server, you might need to specify a set of parameters. For more information, see Security Configuration Guide.
Verifying and maintaining CLI login
Displaying user line configuration and operating status
Perform display tasks in any view.
· Display user line information.
display line [ num1 | { aux | vty } num2 ] [ summary ]
· Display online CLI users.
display users [ all ]
Sending messages to user lines
To send messages to user lines, execute the following command in user view:
send { all | num1 | { aux | vty } num2 }
Releasing user lines
About this task
Multiple users can log in to the device to simultaneously configure the device. When necessary, you can execute this command to release some user connections.
Restrictions and guidelines
You cannot use this command to release the connection you are using.
Procedure
To release user lines, execute the following command in user view:
free line { num1 | { aux | vty } num2 }
Locking the current user line
About this task
You can lock the current user line to prevent unauthorized users from using the line.
Procedure
Perform lock tasks in user view.
· Lock the current user line and set the password for unlocking the line.
lock
To unlock the locked user line, you must press Enter and provide the password you set.
· Lock the current user line and enable unlocking authentication.
lock reauthentication
To unlock the locked user line, you must press Enter and provide the login password to pass reauthentication.
Displaying Telnet client settings
To display Telnet client settings, execute the following command in any view:
Controlling user access to the device
About login user access control
Use ACLs to prevent unauthorized access, and configure command authorization and accounting to monitor and control user behavior.
If an applied ACL does not exist or does not have any rules, no user login restriction is applied. If the ACL exists and has rules, only users permitted by the ACL can access the device.
For more information about ACLs, see ACL and QoS Configuration Guide.
Controlling Telnet and SSH logins
Controlling Telnet logins
1. Enter system view.
system-view
2. Apply an ACL to control Telnet logins.
IPv4:
telnet server acl { advanced-acl-number | basic-acl-number | mac mac-acl-number }
IPv6:
telnet server ipv6 acl { ipv6 { advanced-acl-number | basic-acl-number } | mac mac-acl-number }
By default, no ACL is used to control Telnet logins.
Controlling SSH logins
1. Enter system view.
system-view
2. Apply an ACL to control SSH logins.
IPv4:
ssh server acl { advanced-acl-number | basic-acl-number | mac mac-acl-number }
IPv6:
ssh server ipv6 acl { ipv6 { advanced-acl-number | basic-acl-number } | mac mac-acl-number }
By default, no ACL is used to control SSH logins.
For more information about ssh commands, see Security Command Reference.
Example: Controlling Telnet login
Network configuration
As shown in Figure 5, the device is a Telnet server.
Configure the device to permit only Telnet packets sourced from Host A and Host B.
Prerequisites
By default, interfaces on the device are in ADM or Administratively Down state. To have an interface operate, you must use the undo shutdown command to enable that interface.
Procedure
# Configure an ACL to permit packets sourced from Host A and Host B.
<Sysname> system-view
[Sysname] acl basic 2000 match-order config
[Sysname-acl-ipv4-basic-2000] rule 1 permit source 10.110.100.52 0
[Sysname-acl-ipv4-basic-2000] rule 2 permit source 10.110.100.46 0
[Sysname-acl-ipv4-basic-2000] quit
# Apply the ACL to filter Telnet logins.
[Sysname] telnet server acl 2000
Configuring command authorization
About command authorization
By default, commands available for a user depend only on the user's user roles. When the authentication mode is scheme, you can configure the command authorization feature to further control access to commands.
After you enable command authorization, a user can use only commands that are permitted by both the AAA scheme and user roles.
Restrictions and guidelines
When command authorization is enabled, commands available for a user vary by the user's login authentication mode.
· If authentication is disabled or password authentication is enabled, command authorization does not take effect, and the user cannot use any commands.
· If scheme authentication is enabled, commands available for a user vary by the user's access authentication method.
¡ If local authentication is used, the device uses the user roles assigned to the user to perform command authorization.
¡ If remote authentication is used, the remote authorization server performs command authorization to determine whether a command entered by a login user is permitted. If remote authorization fails, the device uses the user roles of a local user with the same name as the login user to determine whether the command can be used. If the authorization also fails, the login user cannot use the command.
Command authorization configuration changes in user line class view do not take effect on the current session. The changes take effect only on subsequent login sessions. Command authorization configuration changes in user line view take effect immediately on all users that access the user line.
If the remote server performs command authorization, you must configure a command authorization method in ISP domain view. For more information, see AAA configuration in Security Configuration Guide.
Procedure
1. Enter system view.
system-view
2. Enter user line view or user line class view.
¡ Enter user line view.
line { first-number1 [ last-number1 ] | { aux | vty } first-number2 [ last-number2 ] }
¡ Enter user line class view.
line class { aux | vty }
A setting in user line view applies only to the user line. A setting in user line class view applies to all user lines of the class. A non-default setting in either view takes precedence over the default setting in the other view. A non-default setting in user line view takes precedence over the non-default setting in user line class view.
A setting in user line class view takes effect only on users who log in after the setting is made. It does not affect users who are already online when the setting is made.
3. Enable scheme authentication.
authentication-mode scheme
By default, authentication is disabled for console login, and password authentication is enabled for VTY login.
In VTY line view, this command is associated with the protocol inbound command. If one command has a non-default setting in VTY line view, the other command uses its setting in VTY line view, regardless of its setting in VTY line class view.
CAUTION: When you enable scheme authentication, make sure an authentication user account is available. If no authentication user account is available, you cannot log in to the device through the line or line class at the next time. |
4. Enable command authorization.
command authorization
By default, command authorization is disabled, and the commands available for a user only depend on the user role.
If the command authorization command is executed in user line class view, command authorization is enabled on all user lines in the class. You cannot configure the undo command authorization command in the view of a user line in the class.
Example: Configuring command authorization
Network configuration
As shown in Figure 6, Host A needs to log in to the device to manage the device.
Configure the device to perform the following operations:
· Allow Host A to Telnet in after authentication.
· Use the HWTACACS server to control the commands that the user can execute.
· If the HWTACACS server is not available, use local authorization.
Prerequisites
By default, interfaces on the device are in ADM or Administratively Down state. To have an interface operate, you must use the undo shutdown command to enable that interface.
Assign IP addresses to relevant interfaces. Make sure the device and the HWTACACS server can reach each other. Make sure the device and Host A can reach each other.
Procedure
# Enable the Telnet server.
<Device> system-view
[Device] telnet server enable
# Enable scheme authentication for user lines VTY 0 through VTY 4.
[Device] line vty 0 63
[Device-line-vty0-63] authentication-mode scheme
# Enable command authorization for the user lines.
[Device-line-vty0-63] command authorization
[Device-line-vty0-63] quit
# Create HWTACACS scheme tac.
[Device] hwtacacs scheme tac
# Configure the scheme to use the HWTACACS server at 192.168.2.20:49 for authentication and authorization.
[Device-hwtacacs-tac] primary authentication 192.168.2.20 49
[Device-hwtacacs-tac] primary authorization 192.168.2.20 49
# Set the shared keys to expert.
[Device-hwtacacs-tac] key authentication simple expert
[Device-hwtacacs-tac] key authorization simple expert
# Remove domain names from usernames sent to the HWTACACS server.
[Device-hwtacacs-tac] user-name-format without-domain
[Device-hwtacacs-tac] quit
# Configure the system-defined domain (system).
[Device] domain system
# Use HWTACACS scheme tac for login user authentication and command authorization. Use local authentication and local authorization as the backup method.
[Device-isp-system] authentication login hwtacacs-scheme tac local
[Device-isp-system] authorization command hwtacacs-scheme tac local
[Device-isp-system] quit
# Create local user monitor. Set the simple password to hello12345, the service type to Telnet, and the default user role to level-1.
[Device] local-user monitor
[Device-luser-manage-monitor] password simple hello12345
[Device-luser-manage-monitor] service-type telnet
[Device-luser-manage-monitor] authorization-attribute user-role level-1
Configuring command accounting
About command accounting
Command accounting uses the HWTACACS server to record all executed commands to monitor user behavior on the device.
If command accounting is enabled but command authorization is not, every executed command is recorded. If both command accounting and command authorization are enabled, only authorized commands that are executed are recorded.
Restrictions and guidelines
The command accounting method can be the same as or different from the command authorization method and user login authorization method.
For the command accounting feature to take effect, you must configure a command accounting method in ISP domain view. For more information, see AAA in User Access and Authentication Configuration Guide.
Procedure
1. Enter system view.
system-view
2. Enter user line view or user line class view.
¡ Enter user line view.
line { first-number1 [ last-number1 ] | { aux | vty } first-number2 [ last-number2 ] }
¡ Enter user line class view.
line class { aux | vty }
A setting in user line view applies only to the user line. A setting in user line class view applies to all user lines of the class. A non-default setting in either view takes precedence over the default setting in the other view. A non-default setting in user line view takes precedence over the non-default setting in user line class view.
A setting in user line class view takes effect only on users who log in after the setting is made. It does not affect users who are already online when the setting is made.
3. Enable scheme authentication.
authentication-mode scheme
By default, authentication is disabled for console login, and password authentication is enabled for VTY login.
In VTY line view, this command is associated with the protocol inbound command. If one command has a non-default setting in VTY line view, the other command uses its setting in VTY line view, regardless of its setting in VTY line class view.
CAUTION: When you enable scheme authentication, make sure an authentication user account is available. If no authentication user account is available, you cannot log in to the device through the line or line class at the next time. |
4. Enable command accounting.
command accounting
By default, command accounting is disabled. The accounting server does not record the commands executed by users.
If the command accounting command is executed in user line class view, command accounting is enabled on all user lines in the class. You cannot configure the undo command accounting command in the view of a user line in the class.
Example: Configuring command accounting
Network configuration
As shown in Figure 7, users need to log in to the device to manage the device.
Configure the device to send commands executed by users to the HWTACACS server to monitor and control user operations on the device.
Prerequisites
By default, interfaces on the device are in ADM or Administratively Down state. To have an interface operate, you must use the undo shutdown command to enable that interface.
Procedure
# Enable the Telnet server.
<Device> system-view
[Device] telnet server enable
# Enable command accounting for user line AUX 0.
[Device] line aux 0
[Device-line-aux0] command accounting
[Device-line-aux0] quit
# Enable command accounting for user lines VTY 0 through VTY 63.
[Device] line vty 0 63
[Device-line-vty0-63] command accounting
[Device-line-vty0-63] quit
# Create HWTACACS scheme tac.
[Device] hwtacacs scheme tac
# Configure the scheme to use the HWTACACS server at 192.168.2.20:49 for accounting.
[Device-hwtacacs-tac] primary accounting 192.168.2.20 49
# Set the shared key to expert.
[Device-hwtacacs-tac] key accounting simple expert
# Remove domain names from usernames sent to the HWTACACS server.
[Device-hwtacacs-tac] user-name-format without-domain
[Device-hwtacacs-tac] quit
# Configure the system-defined domain (system) to use the HWTACACS scheme for command accounting.
[Device] domain system
[Device-isp-system] accounting command hwtacacs-scheme tac
[Device-isp-system] quit