216
1.877.877.2269
BLACKBOX.COM
NEED HELP?
LEAVE THE TECH TO US
LIVE 24/7
TECHNICAL
SUPPORT
1.877.877.2269
CHAPTER 10: AUTHENTICATION
NOTE: When you are using remote groups with LDAP remote auth, you need to have corresponding local groups on the console
server. Where the LDAP group names can contain upper case and space characters, the local group name on the console
server must be all lower case and the spaces replaced with underscrores. For example, a remote group on the LDAP server
may be My Ldap Access Group. The corresponding local group on the console server must be my_ldap_access_group. The
local group on the console server must specify what the group member is granted access to for any group membership to
be effective.
10.1.9 REMOTE GROUPS WITH AUTHENTICATION
When using authentication, there are two ways to grant a remotely authenticated user privileges. The first is to set the
priv-lvl and port attributes of the raccess service to 12. See Section 10.2 for more information.
Additionally, or alternatively, group names can be provided to the console server using the groupname custom attribute of the
raccess service.
An example Linux tac-plus config snippet might look like:
user = myuser {
service = raccess {
groupname="users"
groupname1="routers"
groupname2="dracs"
}
}
You may also specify multiple groups in one comma-delimited. For example:
groupname="users,routers,dracs"
NOTE: The maximum length of the attribute value string is 255 characters.
To use an attribute name other than "groupname", set the Authentication > > TACACS Group Membership Attribute.
10.1.10 IDLE TIMEOUT
You can specify the time the console server waits before it terminates an idle ssh, pmshell or web connection.
Navigate to Serial & Network > Authentication.
FIGURE 10-8.
Set a Web Management Session Timeout in minutes. This specifies the browser console session idle timeout. The default setting is
20 minutes.
