HPE FlexFabric 5940 SERIES, Руководство по настройке безопасности

Страница: 77 / 571

64
# Create an ISP domain named bbb and configure authentication, authorization, and
accounting methods for login users.
[Switch] domain bbb
[Switch-isp-bbb] authentication login radius-scheme rad
[Switch-isp-bbb] authorization login radius-scheme rad
[Switch-isp-bbb] accounting login none
[Switch-isp-bbb] quit
Verifying the configuration
# Initiate an SSH connection to the switch, and enter the username hello@bbb and the correct
password. The user logs in to the switch. (Details not shown.)
# Verify that the user can use the commands permitted by the network-operator user role. (Details
not shown.)
Authentication for SSH users by an LDAP server
Network requirements
As shown in Figure 17 , an LDAP server is located at 10.1.1.1/24 and uses the domain name
ldap.com .
Configure the switch to meet the following requirements:
•
Use the LDAP server to authenticate SSH users.
•
Assign the default user role network-operator to SSH users after they pass authentication.
On the LDAP server, set the administrator password to admin!123456 , add a user named aaa , and
set the user's password to ldap!123456 .
Figure 17 Network diagram
Configuration procedure
1. Configure the LDAP server:
NOTE:
In this example, the LDAP server runs Microsoft Windows 2003 Server Active Directory.
# Add a user named aaa and set the password to ldap!123456 .
a. On the LDAP server, select Start > Control Panel > Administrative Tools .
b. Double-click Active Directory Users and Computers .
The Active Directory Users and Computers window is displayed.
c. From the navigation tree, click Users under the ldap.com node.