Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet Sensor, Руководство по установке и настройке

Страница: 339 / 450

A-13
Cisco Intrusion Detection System Appliance and Module Installation and Configuration Guide Version 4.1
78-15597-02
Appendix A Intrusion Detection System Architecture
System Components
account’s password has expired. User interface applications that authenticate
users by initiating an execAuthenticateUser control transaction prompt the user to
change the password.
AuthenticationApp uses the underlying operating system to confirm a user’s
identity. All the IDS applications send control transactions to AuthenticationApp,
which then uses the operating system to form its responses.
Remote shell services, Telnet and SSH, are not IDS applications. They call the
operating system directly. If the user is authenticated, it launches the IDS CLI. In
this case, CLI send a special form of the execAuthenticateUser control transaction
to determine the privilege level of the logged-in user. The CLI then tailors the
commands it makes available based on this privilege level.
Configuring Authentication on the Sensor
You must configure authentication on the sensor to establish appropriate security
for user access. When you install a sensor, an initial cisco account with an expired
password is created. A user with administrative access to the sensor accesses the
sensor through the CLI or an IDS manager by logging in to the sensor using the
default administrative account (cisco). In the CLI, the administrator is prompted
to change the password. IDS managers initiate a
setEnableAuthenticationTokenStatus control transaction to change the account’s
password.
Through the CLI or an IDS manager, the administrator configures which
authentication method is used, such as username and password or an SSH
authorized key. The application servicing the administrator initiates a
setAuthenticationConfig control transaction to establish the authentication
configuration.
The authentication configuration includes a login attempt limit value that is used
to specify how account locking is handled. Account locking is invoked when the
number of consecutive failed login attempts for a given account exceeds the login
attempt limit value. After an account is locked, all further attempts to log in to that
account are rejected. The account is unlocked by resetting the account’s
authentication token using the setEnableAuthenticationTokenStatus control
transaction. The account locking feature is disabled when the login attempt limit
value is set to zero.
The administrator can add additional user accounts either through the CLI or an
IDS manager. See
User Account Roles, page A-30 , for more information.