Lucent Technologies Stinger, Administration Manual

Page: 27 / 374

Administering a Stinger System
Managing administrative access to the unit
Stinger® Administration Guide 1-5
---------------------------------------------------------------------------
000 1:09 000 * ie0 - 0.0.0.0/32 134.112.26.201/32
001 1:09 001 * ie1 - 0.0.0.0/32 0.0.0.0/32
002 1:09 002 * lo0 - 0.0.0.0/32 127.0.0.1/32
003 0:00 000 * rj0 - 0.0.0.0/32 127.0.0.2/32
004 0:00 000 * bh0 - 0.0.0.0/32 127.0.0.3/32
005 1:09 000 * wanabe - 0.0.0.0/32 127.0.0.3/32
006 0:00 000 * local - 0.0.0.0/32 127.0.0.1/32
007 0:00 000 * mcast - 0.0.0.0/32 224.0.0.0/32
008 0:00 000 - tunnel0 - 0.0.0.0/32 134.112.26.201/32
009 0:00 000 * vr0_main - 0.0.0.0/32 134.112.26.201/32
010 0:00 000 - sip0 - 0.0.0.0/32 0.0.0.0/32
011 1:05 006 * p wan11 bir-2-2 222.222.222.222/32 222.222.222.1/32
The u column displays an asterisk (*) to indicate that the interface is operational or a
hyphen (-) to indicate that it is disabled.
Securing Telnet access
If the telnet-password parameter in the ip-global profile (without specifying a
user-profile name), you can configure a Stinger system to support mild
authentication for telnet access. When a user attempts to access the system via telnet,
the user must provide a password when prompted. After telnet authentication, the
user goes through the terminal session authentication similar to authentication for
console access.
User authentication can be internal or external based on system configuration. If the
user-profile parameter in the ip-global profile is set with the name of a user
profile, then the terminal session's user authentication is bypassed. To ensure that the
user is authenticated for telnet access, the
user-profile parameter should not be set
to any user profile. See also, “Creating Telnet access control lists” on page 1-15 for
more information about managing Telnet access to the system.
Managing administrative access to the unit
You create and define administrative access to the Stinger unit using user profiles. Do
not confuse them with connection profiles. You configure user profiles to provide
access to the Stinger command-line interface to monitor or configure the unit. In
contrast,
connection profiles contain authentication and configuration information
for a remote device or user and allow the remote user to connect to the Stinger unit
for WAN or LAN access.
You can create any number of user profiles and fine-tune the privileges they allow. In
addition to authentication and permission information, user profiles also contain
parameters that affect how the user’s environment appears at login.
A Stinger unit is shipped with the predefined user profiles admin and default . An
admin user profile provides full read-write permissions, while the default user profile
authorizes minimal use of commands.
Many sites choose to create some administrative accounts with read-only
permissions, to allow certain users to check status windows, read log buffers, and
enter diagnostic commands. You need at least one administrative account with read-
write permissions, but you might choose to create several read-only accounts.