Juniper JUNOSe 11.1, Руководство по настройке

Страница: 461 / 640

■
Use to allow privilege determination to be authenticated through the
or RADIUS server. This command specifies a list of authentication methods that
are used to determine whether a user is granted access to the privilege command
level.
■
The authentication methods that you can use in a list include these options:
radius , line , , none , and enable .
■
To specify that the authentication should succeed even if all methods return an
error, specify
none as the final method in the command line.
■
Requests sent to a or RADIUS server include the username that is
entered for login authentication.
■
If the authentication method list is empty, the local enable password is used.
■
Example
host1(config)# aaa authentication enable default radius
■
Use the no version to empty the list.
■
See aaa authentication enable default.
aaa authentication login
■
Use to set AAA authentication at login. This command creates a list that specifies
the methods of authentication.
■
After you have specified aaa new-model as the authentication method for vty
lines, an authentication list called default is automatically assigned to the vty
lines. To allow users to access the vty lines, you must create an authentication
list and either:
■
Name the list default.
■
Assign a different name to the authentication list, and assign the new list to
the vty line using the
login authentication command.
■
The authentication methods that you can use in a list include these options:
radius , line , , none , and enable .
■
The system traverses the list of authentication methods to determine whether
a user is allowed to start a Telnet session. If a specific method is available but
the user information is not valid (such as an incorrect password), the system
does not continue to traverse the list and denies the user a session.
■
If a specific method is unavailable, the system continues to traverse the list. For
example, if
is the first authentication type element on the list and the
server is unreachable, the system attempts to authenticate with the
next authentication type on the list, such as
radius .
■
The system assumes an implicit denial of service if it reaches the end of the
authentication list without finding an available method.
■
Example
host1(config)# aaa authentication login my_auth_list radius line none
Vty Line Authentication and Authorization
■ 431
Chapter 7: Passwords and Security