11: User Authentication
SLB™ Branch Office Manager User Guide
210
Similar to RADIUS, the main function of is to perform authentication for remote access.
The SLB branch office manager supports the protocol (not the older TACACS or
XTACACS protocols).
The system administrator can configure the SLB branch office manager to use to
authenticate users attempting to log in using the Web, Telnet, SSH, or the console port.
Users who are authenticated through Kerberos are granted device port access through the port
permissions on this page.
All users are members of a group that has predefined user rights associated with it.
You can add additional user rights that are not defined by the group.
Groups
This section describes how a
priv_lvl
assigned to a user can be mapped to a SLB
custom
, which will set the permissions and port rights for a user when they
login to the SLB.
users are typically configured to have a privilege level 0-15, with each level
representing a privilege level that is a superset of the next lower value. The privilege level can be
assigned to individual users, or to groups that the user is a member of. When the SLB
authenticates a user, it will first send an authentication request to the server,
and wait for an authentication reply. If the user is successfully authenticated, the SLB will next
send an authorization request to the server with the
Service
and optional
Protocol
.
The SLB will wait for an authorization response that will indicate if the user was successfully
authorized for the requested service and protocol, and also contains a set of attribute-value pairs
which define the attributes associated with the user.
The
priv_lvl
or
priv-lvl
is the only attribute sent from the server that the SLB will
recognize and utilize. The privilege level number will be used to map to a SLB custom user group
by finding a group with a name that ends in the same number as the
priv_lvl
. For example, a
SLB group called "admin15" will map to any users with
priv_lvl
equal to 15; a SLB
group called "manager8" will map to any users with
priv_lvl
equal to 8, and a SLB
group called "readonly0" will map to any users with
priv_lvl
equal to 0. If two SLB
groups ending with the same number exist, the SLB will select the first matching group it finds
while searching the group list; for consistency it is recommended that only one SLB group exist for
each
priv_lvl
.
When a user authenticates to the SLB, the Authentication Log will record any priv_lvl
attribute-value pair returned by the server:
Sep 21 15:44:38 2017 slc431d SLC-SLB/x15login[2839]:
pam_sm_authenticate: server returned attribute `PRIV_LVL=14'
Any
priv_lvl
obtained for a user can also be viewed at the CLI with the show user
command.
Summary of Contents for 100-120 VAC SLB
Page 114: ...8 Device Ports SLB Branch Office Manager User Guide 114 Figure 8 4 Device Ports Settings ...
Page 131: ...8 Device Ports SLB Branch Office Manager User Guide 131 Figure 8 10 Devices Power Outlets ...
Page 174: ...9 USB Port SLB Branch Office Manager User Guide 174 Figure 9 3 Devices USB Modem ...