Alcatel-Lucent 7950 SR, Руководство по управлению системой

Страница: 108 / 462

General Security Commands
Page 108 7950 SR OS System Management Guide
config>system>security>keychain>direction>uni>send>entry
config>system>security>pki>ca-profile
config>sys>sec>cpm>mac-filter>entry
Description The shutdown command administratively disables the entity. When disabled, an entity does not
change, reset, or remove any configuration settings or statistics. Many entities must be explicitly
enabled using the
no shutdown command. The operational state of the entity is disabled as well as
the operational state of any entities contained within. Many objects must be shut down before they
may be deleted.
The no form of the command puts an entity into the administratively enabled state.
Default
no shutdown
ftp-server
Syntax [ no ] ftp-server
Context config>system>security
Description
This command enables FTP servers running on the system.
FTP servers are disabled by default. At system startup, only SSH server are enabled.
The no form of the command disables FTP servers running on the system.
hash-control
Syntax hash-control [ read-version { 1 | 2 | all }] [ write-version { 1 | 2 }]
no hash-control
Context config>system>security
Description
Whenever the user executes a save or info command, the system will encrypt all passwords, MD5
keys, etc., for security reasons. At present, two algorithms exist.
The first algorithm is a simple, short key that can be copied and pasted in a different location when
the user wants to configure the same password. However, because it is the same password and the
hash key is limited to the password/key, even the casual observer will notice that it is the same key.
The second algorithm is a more complex key, and cannot be copied and pasted in different locations
in the configuration file. In this case, if the same key or password is used repeatedly in different con-
texts, each encrypted (hashed) version will be different.
Default
all — read-version set to accept both versions 1 and 2
Parameters
read-version { 1 | 2 | all } — When the read-version is configured as “all,” both versions 1 and 2 will
be accepted by the system. Otherwise, only the selected version will be accepted when reading con-
figuration or exec files. The presence of incorrect hash versions will abort the script/startup.