Cisco AS5300 - Universal Access Server, Руководство по настройке программного обеспечения, Страница: 123 / 198

Access Service Security 4-17
Configuring Authorization
Configuring Authorization
You typically have three methods for configuring default authorization on the security server:
1 To override the default denial or authorization from a non-existent user, specify authorization at
the top level of the configuration file:
default authorization = permit
2 At the user level, inside the braces of the user declaration, the default for a user who does not have
a service or command explicitly authorized is to deny that service or command. To permit it:
default service = permit
3 At the service authorization level, arguments are processed according to the following algorithm;
for each attribute-value (AV) pair sent from the access server, the following process occurs:
(a) If the AV pair from the access server is mandatory, look for an exact match in the
daemon’s mandatory list. If found, add the AV pair to the output
(b) If an exact match does not exist, look in the daemon’s optional list for the first
attribute match. If found, add the access server AV pair to the output
(c) If no attribute match exists, deny the command if the default is to deny, or if the
default is permit, add the access server AV pair to the output
(d) If the AV pair from the access server is optional, look for an exact AV match in the
mandatory list. If found, add the daemon’s AV pair to the output
(e) If not found, look for the first attribute match in the mandatory list. If found, add the
daemon’s AV pair to the output
(f) If no mandatory match exists, look for an exact AV pair match among the daemon’s
optional AV pairs. If found, add the daemon’s matching AV pair to the output.
(g) If no exact match exists, locate the first attribute match among the daemon’s
optional AV pairs. If found, add the daemon’s matching AV pair to the output.
(h) If no match is found, delete the AV pair if the default is to deny, or if the default is
permit, add the access server AV pair to the output.
(i) If there is no attribute match already in the output list after all AV pairs have been
processed for each mandatory daemon AV pair, add the AV pair (add only one AV
pair for each mandatory attribute).
Configuring Authorization on the Access Server
To specify network authorization (preventing unauthorized users from accessing network resources)
enter the aaa authorization network command. To restrict users from logging into the EXEC
facility, enter the aaa authorization exec command. For example:
5300(config)# aaa authorization network
5300(config)# aaa authorization exec
Note You can also require authorization before a user can enter specific commands by using the
aaa authorization command. For more information, refer to the Security Configuration Guide,
available online at
http://www.cisco.com/univercd/cc/td/doc/product/software/ios113ed/113ed_cr/secur_c/