48
To do…
Use the command…
Remarks
Enter the default
ISP domain
view
domain
domain-name
Apply the
specified AAA
scheme to the
domain
authentication default
{
hwtacacs-scheme
hwtacacs-scheme-name
[
local
] |
local
|
none
|
radius-scheme
radius-scheme-name
[
local
] }
Configure the
authentication
mode
Exit to system
view
quit
Optional
By default, the AAA scheme is
local
.
If you specify the local AAA scheme,
perform the configuration concerning local
user as well. If you specify an existing
scheme by providing the
radius
-
scheme-name
argument, perform
the following configuration as well:
•
For RADIUS and HWTACACS
configuration, see
Security
Configuration Guide
.
•
Configure the username and password
on the AAA server. (For more
information, see
Security Configuration
Guide
.)
Create a local user and enter local
user view
local-user
user-name
Required
By default, no local user exists.
Set the local password
password
{
cipher
|
simple
}
password
Required
By default, no local password is set.
Specify the command level of the
local user
authorization-attribute
level
level
Optional
By default, the command level is 0.
Specify the service type for the
local user
service-type
ssh
Required
By default, no service type is specified.
Return to system view
quit
—
Create an SSH user, and specify
the authentication mode for the
SSH user
ssh user
username
service-type stelnet
authentication-type
{
password
| {
any
|
password-publickey
|
publickey
}
assign
publickey
keyname
}
Required
By default, no SSH user exists, and no
authentication mode is specified.
Configure common settings for VTY
user interfaces
—
Optional
See “
Configuring common settings for VTY
.”
NOTE:
This chapter describes how to configure an SSH client by using
password
authentication. For more
information about SSH and how to configure an SSH client by using publickey, see
Security Configuration
Guide.
After you enable command authorization or command accounting, you need to perform the following
configuration to make the function take effect:
•
Create a HWTACACS scheme, and specify the IP address of the authorization server and other
authorization parameters.
•
Reference the created HWTACACS scheme in the ISP domain.
