Dell BigIron RX Series, Руководство по настройке

Страница: 168 / 1458

92 BigIron RX Series Configuration Guide
53-1002253-01
Configuring TACACS and security
4
BigIron RX(config)# aaa authentication enable implicit-user
Syntax: [no] aaa authentication enable implicit-user
Telnet/SSH prompts when the server is unavailable
When is the first method in the authentication method list, the device displays the login
prompt received from the server. If a user attempts to login through Telnet or SSH, but
none of the configured servers are available, the following takes place:
•
If the next method in the authentication method list is "enable", the login prompt is skipped,
and the user is prompted for the Enable password (that is, the password configured with the
enable super-user-password command).
•
If the next method in the authentication method list is "line", the login prompt is skipped, and
the user is prompted for the Line password (that is, the password configured with the enable
telnet password command).
Configuring authorization
The device supports authorization for controlling access to management functions in the
CLI. Two kinds of authorization are supported:
•
Exec authorization determines a user’s privilege level when they are authenticated
•
Command authorization consults a server to get authorization for commands entered
by the user
Configuring Exec authorization
When exec authorization is performed, the device consults a server to
determine the privilege level of the authenticated user.
To configure exec authorization on the device, enter the following command.
BigIron RX(config)# aaa authorization exec default
Syntax: aaa authorization exec default | radius | none
If you specify none, or omit the aaa authorization exec command from the device’s configuration,
no exec authorization is performed.
A user’s privilege level is obtained from the server in the “foundry-privlvl” A-V pair. If the
aaa authorization exec default tacacs command exists in the configuration, the device assigns the
user the privilege level specified by this A-V pair. If the command does not exist in the configuration,
then the value in the “foundryprivlvl” A-V pair is ignored, and the user is granted Super User access.
NOTE
If the aaa authorization exec default command exists in the configuration, following
successful authentication the device assigns the user the privilege level specified by the
“foundry-privlvl” A-V pair received from the server. If the aaa authorization exec default
command does not exist in the configuration, then the value in the “foundry-privlvl” A-V pair
is ignored, and the user is granted Super User access.