HP HP ProCurve Series 6600, Access Security Manual

Page: 275 / 778

6-41
RADIUS Authentication, Authorization, and Accounting
Commands Authorization
User1 is blocked from executing all commands that contain “config” in the
name, which includes the following commands:
configure
show running-config (sh run)
show config
To block User 1 from executing only the “configure” command, the regular
expression would be:
User1 User-Password = “hpswitch”
Service-Type = Administrative-User,
HP-Command-Exception = 1, # Deny_list
HP-Command-String = “^configure$”
The ^ metacharacter defines the start of the string and the $ character defines
the end of the string. Do not leave a space between the semi-colon and the
start of the next regular expression. So the HP-Command-String with more
than one regular expression defined may look as follows:
HP-Command-String = “^configure$;^show running-config$”.
In this case, User1 is blocked from executing the commands “configure” and
“show running-config” but is able to execute the “show config” command.
The attributes supported with
commands
authorization are:
■
HP-Command-String: List of commands (regular expressions) that
are permitted (or denied) execution by the user. The commands are
delimited by semi-colons and must be between 1 and 249 characters
in length. Multiple instances of this attribute may be present in
Access-Accept packets. (A single instance may be present in
Accounting-Request packets.)
■ HP-Command-Exception: A flag that specifies whether the
commands indicated by the HP-Command-String attribute are
permitted or denied to the user. A zero (0) means permit all listed
commands and deny all others; a one (1) means deny all listed
commands and permit all others.
The results of using the HP-Command-String and HP-Command-Exception
attributes in various combinations are shown below.