Chapter 29: Security
STANDARD Revision 1.0
C4® CMTS Release 8.3 User Guide
© 2016 ARRIS Enterprises LLC. All Rights Reserved.
834
In the figure above, the C4/c CMTS and the Router are AAA clients that defer login authentication and command
authorization responsibilities to remote servers. Information regarding each authentication or authorization exchange is
forwarded to accounting servers where historical records of user activity are maintained.
Note that the AAA model itself does not demand a distributed security scheme but simply offers enough flexibility to
accommodate it. Any or all of the AAA functions can be administered locally at an element. For example, an element can
defer login authentication to a remote authority while authorizing each command locally based on element-specific policy
such as the user’s privilege level. Similarly, an element can authenticate locally (e.g., from a password file) while deferring
authorization to an external server on a per-command basis.
Line Interfaces
Login and enable services are available via telnet -- or virtual terminal -- sessions over the SCM maintenance ethernet
interface located on the SCM Peripheral Interface Card or RPIC and via the console. Since each interface offers a different
level of physical security, each may require a different level of AAA services or possibly none at all. These interfaces are
referred to as "lines" and provide AAA configuration capabilities on a per-line basis. The line interface is also the target of
non-AAA configuration parameters such as data rate, session timeout value, idle timeout value, pagination, and line
password. Cisco’s line interface model is included as part of this feature.
A line is any point of origin for a CLI session. The C4/c CMTS currently supports two types of lines: console lines and vty
(virtual terminal) lines. A console line is a CLI session over the RPIC’s console port, while a vty line is a CLI session over a
virtual terminal.
All lines are independently configurable. This allows an operator to modify the configuration of a given line without
affecting the configuration of other lines of the same type. For example, a user logged in on vty 0 may disable/enable
pagination without disturbing the state of pagination on vty lines 1 through 15.
The following is a summary of the provisioning of the line interfaces:
Configuration information includes at least session timeout, idle timeout, pagination mode, and password.
The C4/c CMTS maintains unique parameter values for two console lines (one for each SCM) and sixteen vty (virtual
terminal) lines numbered 0 through 15. The session timeout provides the maximum session length in seconds. A value
of zero (default) indicates no timeout. The idle timeout provides the maximum idle time in seconds. A value of zero
(default) indicates no timeout. The pagination mode provides the number of lines of consecutive output to display
before pausing and prompting. A value of zero (default) indicates no pagination. The password provides the line
