20
Step Command
Remarks
3.
(Optional.) Configure a
password for the local
user.
•
For a network access user:
password
{
cipher
|
simple
}
password
•
For a device management user
in non-FIPS mode:
password
[ {
hash
|
simple
}
password
]
•
For a device management user
in FIPS mode:
password
Network access user passwords are
encrypted with the encryption
algorithm and saved in ciphertext.
Device management user passwords
are encrypted with the hash
algorithm and saved in ciphertext.
A local user with no password
configured directly passes
authentication after providing the
valid local username and attributes.
To enhance security, configure a
password for each local user.
4.
Assign services for the
local user.
•
In non-FIPS mode:
service-type
{
ftp
|
lan-access
|
{
ssh
|
telnet
|
terminal
} * }
•
In FIPS mode:
service-type
{
lan-access
| {
ssh
|
terminal
} * }
By default, no service is authorized to
a local user.
5.
(Optional.) Place the local
user to the
active
or
blocked
state.
state
{
active
|
block
}
By default, a created local user is in
active
state and can request network
services.
6.
(Optional.) Configure
binding attributes for the
local user.
bind-attribute
{
ip
ip-address
|
location
port
slot-number
subslot-number
port-number
|
mac
mac-address
|
vlan
vlan-id
} *
By default, no binding attribute is
configured for a local user.
Binding attribute
ip
applies only to
LAN users using 802.1X.
Binding attributes
location
,
mac
, and
vlan
apply only to LAN users.
7.
(Optional.) Configure
authorization attributes for
the local user.
authorization-attribute
{
acl
acl-number
|
idle-cut
minute
|
user-role
role-name
|
vlan
vlan-id
|
work-directory
directory-name
} *
The following default settings apply:
•
No authorization ACL, idle
timeout period, or authorized
VLAN is configured for local
users.
•
FTP, SFTP, or SCP users are
authorized access to the root
directory of the device, but they
do not have the access
permission.
•
The network-operator user role is
assigned to local users that are
created by a network-admin or
level-15 user.
For LAN users, only the settings for
acl
,
idle-cut
, and
vlan
take effect.
For Telnet and terminal users, only
the setting for
user-role
takes effect.
For SSH and FTP users, only the
settings for
user-role
and
work-directory
take effect.
For other types of local users, no
authorization attribute takes effect.