Dell PowerConnect B-FCXs, Руководство по настройке

Страница: 1236 / 1494

1194 PowerConnect B-Series FCX Configuration Guide
53-1002266-01
Configuring RADIUS security
32
Configuring RADIUS authorization
Dell PowerConnect devices support RADIUS authorization for controlling access to management
functions in the CLI. Two kinds of RADIUS authorization are supported:
•
Exec authorization determines a user privilege level when they are authenticated
•
Command authorization consults a RADIUS server to get authorization for commands entered
by the user
Configuring exec authorization
When RADIUS exec authorization is performed, the Dell PowerConnect device consults a RADIUS
server to determine the privilege level of the authenticated user. To configure RADIUS exec
authorization on the Dell PowerConnect device, enter the following command.
PowerConnect(config)#aaa authorization exec default radius
Syntax: aaa authorization exec default radius | none
If you specify none, or omit the aaa authorization exec command from the device configuration, no
exec authorization is performed.
NOTE
If the aaa authorization exec default radius command exists in the configuration, following
successful authentication the device assigns the user the privilege level specified by the
foundry-privilege-level attribute received from the RADIUS server. If the aaa authorization exec
default radius command does not exist in the configuration, then the value in the
foundry-privilege-level attribute is ignored, and the user is granted Super User access.
Also note that in order for the aaa authorization exec default radius command to work, either the
aaa authentication enable default radius command, or the aaa authentication login privilege-mode
command must also exist in the configuration.
Configuring command authorization
When RADIUS command authorization is enabled, the Dell PowerConnect device consults the list of
commands supplied by the RADIUS server during authentication to determine whether a user can
execute a command he or she has entered.
You enable RADIUS command authorization by specifying a privilege level whose commands
require authorization. For example, to configure the Dell PowerConnect device to perform
authorization for the commands available at the Super User privilege level (that is; all commands
on the device), enter the following command.
PowerConnect(config)#aaa authorization commands 0 default radius
Syntax: aaa authorization commands <privilege-level> default radius | | none
The <privilege-level> parameter can be one of the following:
•
0 – Authorization is performed (that is, the Dell PowerConnect device looks at the command
list) for commands available at the Super User level (all commands)
•
4 – Authorization is performed for commands available at the Port Configuration level
(port-config and read-only commands)