17
To avoid problems, H3C recommends that administrators log in with a lower privilege level to view
switch operating parameters, and switch to a higher level temporarily only when they must maintain the
device.
When administrators must leave for a while or ask someone else to manage the device temporarily, they
can switch to a lower privilege level before they leave to restrict the operation by others.
Configuring the authentication parameters for user privilege level switching
A user can switch to a lower privilege level without authentication. To switch to a higher privilege level,
however, a user must provide the privilege level switching authentication information (if any).
shows the privilege level switching authentication modes supported by the device.
Table 8
Privilege level switching authentication modes
Authentication
mode
Keywords Description
Local password
authentication
only (local-only)
local
The device uses the locally configured passwords for privilege level switching
authentication.
To use this mode, you must set the passwords for privilege level switching
using the
super password
command.
Remote AAA
authentication
through
HWTACACS or
RADIUS
scheme
The device sends the username and password for privilege level switching to
the HWTACACS or RADIUS server for remote authentication.
To use this mode, you must perform the following configuration tasks:
•
Configure the required HWTACACS or RADIUS schemes and configure
the ISP domain to use the schemes for users. For more information, see
Security Configuration Guide
.
•
Add user accounts and specify the user passwords on the HWTACACS
or RADIUS server.
Local password
authentication
first and then
remote AAA
authentication
local
scheme
The device first uses the locally configured passwords for privilege level
switching authentication. If no local password is set, the device allows
console users to switch their privilege levels without authentication, but
performs AAA authentication for VTY users.
Remote AAA
authentication
first and then
local password
authentication
scheme
local
AAA authentication is performed first, and if the remote HWTACACS or
RADIUS server does not respond or AAA configuration on the device is
invalid, the local password authentication is performed.
To configure the authentication parameters for a user privilege level:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Set the authentication mode
for user privilege level
switching.
super authentication-mode
{
local
|
scheme
}
*
Optional.
By default, local-only
authentication is used.
3.
Configure the password for
the user privilege level.
super password
[
level
user-level
]
{
cipher
|
simple
}
password
If local authentication is involved,
this step is required.
By default, a privilege level has no
password.
