Lenovo Flex System Fabric CN4093, Инструкция по применению

Страница: 107 / 634

© Copyright Lenovo 2017 Chapter 5: Authentication & Authorization Protocols
107
Command Authorization and Logging
When Command Authorization is enabled, ENOS configuration
commands are sent to the server for authorization. Use the following
command to enable Command Authorization:
When Command Logging is enabled, ENOS configuration commands
are logged on the server. Use the following command to enable
Command Logging:
The following examples illustrate the format of Enterprise NOS commands sent to
the server:
The following rules apply to command authorization and logging:

Only commands from a Console, Telnet, or SSH connection are sent for authori ‐
zation and logging. SNMP, BBI, or file ‐ copy commands (for example, TFTP or
sync) are not sent.
 Only leaf ‐ level commands are sent for authorization and logging. For example:
is not sent, but the following command is sent:

The full path of each command is sent for authorization and logging. For
example:
 Command arguments are not sent for authorization.
 Only executed commands are logged.
 Invalid commands are checked by Enterprise NOS and are not sent for authori ‐
zation or logging.
CN 4093(config) # tacacs-server command-authorization
CN 4093(config) # tacacs-server command-logging
authorization request, cmd=cfgtree, cmd-arg=/cfg/l3/if
accounting request, cmd=/cfg/l3/if, cmd-arg=1
authorization request, cmd=cfgtree, cmd-arg=/cfg/l3/if/ena
accounting request, cmd=/cfg/l3/if/ena
authorization request, cmd=cfgtree, cmd-arg=/cfg/l3/if/addr
accounting request, cmd=/cfg/l3/if/addr, cmd-arg=10.90.90.91
authorization request, cmd=apply
accounting request, cmd=apply
CN 4093(config)#
CN 4093(config)# tacacs-server command-logging
CN 4093(config)# tacacs-server command-logging