18
•
If the user interface authentication mode (set by the
authentication-mode
command in user
interface view) is AAA (
scheme
), which commands a login user can use after login depends on the
privilege level authorized to the user. If the user interface authentication mode is password
(
password
) or no authentication (
none
), which commands a login user can use after login depends
on the level configured for the user interface (set by the
user privilege level
command in user
interface view). For an SSH user using public key authentication, which commands are available
depends on the level configured for the user interface. For more information about user interface
authentication mode and user interface command level, see
Fundamentals Configuration Guide
.
•
You can configure the user profile authorization attribute in local user view, user group view, and ISP
domain view. The setting in local user view has the highest priority, and that in ISP domain view has
the lowest priority. For more information about user profiles, see "
•
You cannot delete a local user who is the only security log manager in the system, nor can you
change or delete the security log manager role of the user. To do so, you must specify a new security
log manager first.
To configure local user attributes:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Add a local user and enter
local user view.
local-user
user-name
No local user exists by default.
3.
Configure a password for the
local user.
•
In non-FIPS mode:
password
[ [
hash
] {
cipher
|
simple
}
password
]
•
In FIPS mode:
password
Optional.
A local user with no password
configured passes authentication
after providing the valid local
username and attributes. To
enhance security, configure a
password for each local user.
If none of the parameters is
specified, you enter the interactive
mode to set a plaintext password.
This interactive mode is available
only on switches that support the
password control feature.
4.
Specify the service types for
the local user.
•
In non-FIPS mode:
service-type
{
ftp
|
lan-access
|
{
ssh
|
telnet
|
terminal
} * |
portal
|
web
}
•
In FIPS mode:
service-type
{
lan-access
| {
ssh
|
terminal
} * |
portal
|
web
}
By default, no service is authorized
to a local user.
5.
Place the local user to the
state of active or blocked.
state
{
active
|
block
}
Optional.
When created, a local user is in
active state by default, and the user
can request network services.
