Lenovo Flex System Fabric CN4093, Application Manual

Page: 109 / 634

© Copyright Lenovo 2017 Chapter 5: Authentication & Authorization Protocols
109
Password Change
Enterprise NOS supports password change. When enabled, users can
change their passwords after successful authorization. Use the
following command to enable or disable this feature:
Use the following commands to change the password for the primary and
secondary servers:
Configuring Authentication on the Switch
1.
Configure the IPv4 addresses of the Primary and Secondary servers, and
enable TACACS authentication.
2.
Configure the secret and second secret.
If you configure the secret using any method other than a direct console
connection, the secret may be transmitted over the network as clear text.
3.
If desired, you may change the default TCP port number used to listen to
. The well ‐ known port for is 49.
4.
Configure the number of retry attempts, and the timeout period.
5.
Configure custom privilege ‐ level mapping (optional).
CN 4093(config)# [no] tacacs-server password-change
CN 4093(config)# tacacs-server chpassp
(Change primary password)
CN 4093(config)# tacacs-server chpasss
(Change secondary password)
Enter primary server IPv4 address:
CN 4093(config)# tacacs-server primary-host 10.10.1.1
CN 4093(config)# tacacs-server primary-host mgt-port
Enter secondary server IPv4 address:
CN 4093(config)# tacacs-server secondary-host 10.10.1.1
CN 4093(config)# tacacs-server secondary-host data-port
CN 4093(config)# tacacs-server enable
CN 4093(config)# tacacs-server primary-host 10.10.1.1 key
<1 ‐ 32 character secret>
CN 4093(config)# tacacs-server secondary-host 10.10.1.2 key
<1 ‐ 32 character secret>
CN 4093(config)# tacacs-server port
<TCP port number>
CN 4093(config)# tacacs-server retransmit 3
CN 4093(config)# tacacs-server timeout 5
CN 4093(config)# tacacs-server user-mapping 2 user
CN 4093(config)# tacacs-server user-mapping 3 user
CN 4093(config)# tacacs-server user-mapping 4 user
CN 4093(config)# tacacs-server user-mapping 5 oper