HP E3800 Series, Access Security Manual

Page: 254 / 732

6-38
RADIUS Authentication, Authorization, and Accounting
Commands Authorization
Displaying Authorization Information
You can show the authorization information by entering this command:
An example of the output is shown.
Figure 6-15. Example of Show Authorization Command
Configuring Commands Authorization on a RADIUS
Server
Using Vendor Specific Attributes (VSAs)
Some RADIUS-based features implemented on HP switches use HP VSAs for
information exchange with the RADIUS server. RADIUS Access-Accept pack-
ets sent to the switch may contain the vendor-specific information. The
attributes supported with
commands authorization are:
■
HP-Command-String: List of commands (regular expressions) that
are permitted (or denied) execution by the user. The commands are
delimited by semi-colons and must be between 1 and 249 characters
in length. Multiple instances of this attribute may be present in
Access-Accept packets. (A single instance may be present in
Accounting-Request packets.)
■
HP-Command-Exception: A flag that specifies whether the
commands indicated by the HP-Command-String attribute are
permitted or denied to the user. A zero (0) means permit all listed
commands and deny all others; a one (1) means deny all listed
commands and permit all others.
Syntax: show authorization
Configures authorization for controlling access to CLI
commands. When enabled, the switch checks the list of commands
supplied by the RADIUS server during user authentication to
determine if a command entered by the user can be executed.
HP Switch(config)# show authorization
Status and Counters - Authorization Information
Type | Method
-------- + ------
Commands | RADIUS