5-16
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
Chapter 5 Configuring the Management Interface and Security
Authentication, Authorization, and Accounting
The login and password prompts may be provided by the server, or if the server
does not provide the prompts, then the local prompts will be used.
The user log in information (user name and password) is transmitted to the server for
authentication. If the server indicates that the user is not authenticated, the user will be
re-prompted for the user name and password. The user is re-prompted a user-configurable number of
times, after which the failed login attempt is recorded in the Cisco SCE platform user log and the telnet
session is terminated (unless the user is connected to the console port.)
The Cisco SCE platform will eventually receive one of the following responses from the
server:
•
ACCEPT – The user is authenticated and service may begin.
•
REJECT – The user has failed to authenticate. The user may be denied further access, or will be
prompted to retry the login sequence depending on the server.
•
ERROR – An error occurred at some time during authentication. This can be either at the server or
in the network connection between the server and the Cisco SCE platform. If an ERROR response
is received, the Cisco SCE platform will try to use an alternative method\server for authenticating
the user.
•
CONTINUE – The user is prompted for additional authentication information.
If the server is unavailable, the next authentication method is attempted, as explained in
Fallback and Recovery Mechanism” section on page 5-17
.
Accounting
The accounting supports the following functionality:
•
Each executed command (the command must be a valid one) will be logged using the
accounting mechanism (including login and exit commands).
•
The command is logged both before and after it is successfully executed.
•
Each accounting message contains the following:
–
User name
–
Current time
–
Action performed
–
Command privilege level
accounting is in addition to normal local accounting using the Cisco SCE platform dbg log.
Privilege-Level Authorization
After a successful login the user is granted a default privilege level of 0, giving the user the ability to
execute a limited number of commands. Changing privilege level is done by executing the "enable"
command. This command initiates the privilege level authorization mechanism.
Privilege level authorization in the Cisco SCE platform is accomplished by the use of an "enable"
command authentication request. When a user requests an authorization for a specified privilege level,
by using the "enable" command, the Cisco SCE platform sends an authentication request to the
server specifying the requested privilege level. The Cisco SCE platform grants the requested
privilege level only after the server does the following:
•
Authenticates the "
enable
" command password
