20
Configuring user group attributes
User groups simplify local user configuration and management. A user group consists of a group of local
users and has a set of local user attributes. You can configure local user attributes for a user group to
implement centralized user attributes management for the local users in the group. Configurable user
attributes include password control attributes and authorization attributes.
By default, every newly added local user belongs to the system default user group system and bears all
attributes of the group. To change the user group to which a local user belongs, use the
user-group
command in local user view.
To configure attributes for a user group:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Create a user group and enter
user group view.
user-group
group-name
N/A
3.
Configure password control
attributes for the user group.
•
Set the password aging time:
password-control aging
aging-time
•
Set the minimum password
length:
password-control length
length
•
Configure the password
composition policy:
password-control composition
type-number
type-number
[
type-length
type-length
]
Optional.
By default, the user group uses
global password control attribute
settings.
For more information about
password control attributes
configuration commands, see
Security Command Reference
.
4.
Configure the authorization
attributes for the user group.
authorization-attribute
{
acl
acl-number
|
idle-cut
minute
|
level
level
|
user-profile
profile-name
|
vlan
vlan-id
|
work-directory
directory-name
} *
Optional.
By default, no authorization
attribute is configured for a user
group.
5.
Set the guest attribute for the
user group.
group-attribute
allow-guest
Optional.
By default, the guest attribute is not
set for a user group, and guest
users created by a guest manager
through the Web interface cannot
join the group.
Displaying and maintaining local users and local user groups
Task Command
Remarks
Display local user information
display local-user
[
idle-cut
{
disable
|
enable
} |
service-type
{
ftp
|
lan-access
|
portal
|
ssh
|
telnet
|
terminal
|
web
} |
state
{
active
|
block
} |
user-name
user-name
|
vlan
vlan-id
] [
slot
slot-number
] [
|
{
begin
|
exclude
|
include
}
regular-expression
]
Available in any view
