HP HP ProCurve Series 6600, Access Security Manual

Page: 216 / 778

5-12
Authentication
Configuring on the Switch
Authentication Parameters
Table 5-1. AAA Authentication Parameters
Configuring the Server for Single Login
In order for the single login feature to work correctly, you need to check some
entries in the User Setup on the server.
In the User Setup, scroll to the Advanced Settings section. Make
sure the radio button for “Max Privilege for any AAA Client” is checked and
the level is set to 15, as shown in Figure 5-4. Privileges are represented by the
Name Default Range Function
console, Telnet,
SSH, web or port-
access n/a n/a Specifies the access method used when authenticating.
authentication only uses the console, Telnet or SSH access methods.
enable n/a n/a Specifies the Manager (read/write) privilege level for the access
method being configured.
login <privilege-
mode> privilege-mode
disabled n/a login: Specifies the Operator (read-only) privilege level for the
access method being configured.
The
privilege-mode option enables for a single login. The
authorized privilege level (Operator or Manager) is returned to the
switch by the server.
local
- or -
tacacs
local n/a Specifies the primary method of authentication for the access
method being configured.
local: Use the username/password pair configured locally in the
switch for
the privilege level being configured
tacacs: Use a server.
local
- or -
none
none n/a Specifies the secondary (backup) type of authentication being
configured.
local: The username/password pair configured locally in the switch
for the
privilege level being configured
none: No secondary type of authentication for the specified
method/privilege path. (Available only if the primary method of
authentication for the access being configured is local.)
Note:
If you do not specify this parameter in the command line, the
switch automatically assigns the secondary method as follows:
• If the primary method is
tacacs
, the only secondary method is
local
.
• If the primary method is
local
, the default secondary method is
none
.
num-attempts 3 1 - 10 In a given session, specifies how many tries at entering the correct
username/password pair are allowed before access is denied and
the session terminated.