Cisco 500 Series, Руководство по настройке

Страница: 210 / 1140

13-8
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 13 Configuring AAA Servers and the Local Database
Configuring the Local Database
where the username keyword is a string from 4 to 64 characters long.
The password password argument is a string from 3 to 16 characters long.
The mschap keyword specifies that the password is e converted to unicode and hashed using MD4 after
you enter it. Use this keyword if users are authenticated using MSCHAPv1 or MSCHAPv2.
The privilege level argument sets the privilege level from 0 to 15. The default is 2. This privilege level
is used with command authorization.
Caution
If you do not use command authorization (the aaa authorization command LOCAL command), then
the default level 2 allows management access to privileged EXEC mode. If you want to limit access to
privileged EXEC mode, either set the privilege level to 0 or 1, or use the
service-type command (see
Step 4 ).
The nopassword keyword creates a user account with no password.
Note
The encrypted and nt-encrypted keywords are typically for display only. When you define a password
in the username command, the security appliance encrypts it when it saves it to the configuration for
security purposes. When you enter the show running-config command, the username command does
not show the actual password; it shows the encrypted password followed by the encrypted or
nt-encrypted keyword (when you specify mschap ). For example, if you enter the password “test,” the
show running-config display would appear to be something like the following:
username pat password DLaUiAX3l78qgoB5c7iVNw== nt-encrypted
The only time you would actually enter the encrypted or nt-encrypted keyword at the CLI is if you are
cutting and pasting a configuration to another security appliance and you are using the same password.
Step 2 (Optional) To enforce user-specific access levels for users who authenticate for management access (see
the
aaa authentication console LOCAL command), enter the following command:
hostname(config)# aaa authorization exec authentication-server
This command enables management authorization for local users and for any users authenticated by
RADIUS, LDAP, and . See the
“Limiting User CLI and ASDM Access with Management
Authorization” section on page 40-7 for information about configuring a user on a AAA server to
accommodate management authorization.
For a local user, configure the level of access using the service-type command as described in Step 4 .
Step 3
(Optional) To configure username attributes, enter the following command:
hostname(config)#
username
username
attributes
where the username argument is the username you created in Step 1 .
Step 4
(Optional) If you configured management authorization in Step 2 , enter the following command to
configure the user level:
hostname(config-username)#
service-type
{
admin
|
nas-prompt
|
remote-access
}
where the admin keyword allows full access to any services specified by the aaa authentication console
LOCAL commands. admin is the default.