51
# Create ISP domain
bbb
and configure the domain to use the HWTACACS scheme for
authentication, authorization, and accounting of login users.
[Switch] domain bbb
[Switch-isp-bbb] authentication login hwtacacs-scheme hwtac
[Switch-isp-bbb] authorization login hwtacacs-scheme hwtac
[Switch-isp-bbb] accounting login hwtacacs-scheme hwtac
[Switch-isp-bbb] quit
# Create local RSA and DSA key pairs.
[Switch] public-key local create rsa
[Switch] public-key local create dsa
# Enable the SSH service.
[Switch] ssh server enable
# Enable scheme authentication for user lines VTY 0 through VTY 63.
[Switch] line vty 0 63
[Switch-line-vty0-63] authentication-mode scheme
[Switch-line-vty0-63] quit
# Enable the default user role feature to assign authenticated SSH users the default user role
network-operator
.
[Switch] role default-role enable
Verifying the configuration
# Initiate an SSH connection to the switch, and enter the username
hello@bbb
and the password.
The user logs in to the switch. (Details not shown.)
# Verify that the user can use the commands permitted by the network-operator user role. (Details
not shown.)
Local authentication, HWTACACS authorization, and
RADIUS accounting for SSH users
Network requirements
As shown in
, configure the switch to meet the following requirements:
•
Perform local authentication for SSH servers.
•
Use the HWTACACS server and RADIUS server for SSH user authorization and accounting,
respectively.
•
Exclude domain names from the usernames sent to the servers.
•
Assign the default user role
network-operator
to SSH users after they pass authentication.
Configure an account with the username
hello
for the SSH user. Configure the shared keys for
secure communication with the HWTACACS server and RADIUS server to
expert
.
