17
Authorization attributes
Authorization attributes indicate the rights that a user has after passing local authentication.
Authorization attributes include the ACL, PPP callback number, idle cut function, user level, user role,
user profile, VLAN, and FTP/SFTP work directory. For more information, see "
Every configurable authorization attribute has its definite application environments and purposes. When
configuring authorization attributes for a local user, consider which attributes are needed and which are
not. For example, for PPP users, you do not need to configure the work directory attribute.
Configure an authorization attribute in user group view or local user view, making the attribute effective
for all local users in the group or for only the local user. The setting of an authorization attribute in local
user view takes precedence over that in user group view.
Local user configuration task list
Task Remarks
Configuring local user attributes
Required
Configuring user group attributes
Optional
Displaying and maintaining local users and local user groups
Optional
Configuring local user attributes
To do…
Command…
Remarks
1.
Enter system view.
system-view
—
2.
Set the password display
mode for all local users.
local-user password-
display-mode
{
auto
|
cipher-force
}
Optional.
auto
by default, indicating to display the
password of a local user in the way defined
by
password
.
3.
Add a local user and enter
local user view.
local-user
user-name
Required.
No local user exists by default.
4.
Configure a password for the
local user.
password
{
cipher
|
simple
}
password
Optional.
If you do not configure any password for a
local user, the local user does not need to
provide any password during authentication
and can pass authentication after entering
the correct local user name and passing
attribute checks. To achieve higher security,
configure a password for each local user.
5.
Specify the service types for
the local user.
service-type
{
dvpn
|
ftp
|
lan-access
| {
ssh
|
telnet
|
terminal
} *
|
portal
|
ppp
|
web
}
Required.
By default, no service is authorized to a local
user.
The
web
keyword is available only on
centralized routers.
The
lan-access
keyword is supported only on
routers with SAP modules.
