Juniper JUNOSE 11.3, Configuration Manual

Page: 443 / 632

Vty Line Authentication and Authorization
The router supports 30 virtual tty (vty) lines for Telnet, Secure Shell Server (SSH) and
FTP services. Each Telnet, SSH, or FTP session requires one vty line. You can add security
to your router by configuring the software to validate login requests. There are two modes
of authentication for a vty line:
• Simple authentication—Password-only authentication through the local configuration
• AAA authentication—Username and password authentication through a set of
authentication servers
You can enable AAA authorization, which allows you to limit the services available to a
user. Based on information retrieved from a user’s profile, the user is either granted or
denied access to the requested server.
Configuring Simple Authentication
To configure simple authentication:
1.
Specify a vty line or a range of vty lines on which you want to enable the password.
host1(config)# line vty 8 13
host1(config-line)#
2.
Specify the password for the vty lines.
host1(config-line)# password 0 mypassword
3.
Enable login authentication on the lines.
host1(config-line)# login
4.
Display your vty line configuration.
host1# show line vty 8
no access-class in
data-character-bits 8
exec-timeout never
exec-banner enabled
motd-banner enabled
login-timeout 30 seconds
line
•
Use to specify the vty lines on which you want to enable the password.
•
You can set a single line or a range of lines. The range is 0–29.
•
Example
host1(config)# line vty 8 13
•
Use the no version to remove a vty line or a range of lines from your configuration; users
will not be able to run Telnet, SSH, or FTP to lines that you remove. When you remove
413 Copyright © 2010, Juniper Networks, Inc.
Chapter 7: Passwords and Security