ZyXEL Communications OLT2406, Руководство пользователя

Страница: 460 / 766

Chapter 59 AAA
OLT2406 User’s Guide
460
C
HAPTER
59
AAA
59.1 AAA Overview
Use these commands to configure authentication, authorization and accounting on the OLT.
Authentication, Authorization, Accounting (AAA)
Authentication is the process of determining who a user is and validating access to the system. The
system can authenticate users who try to log in based on user accounts configured on the system itself.
The system can also use an external authentication server to authenticate a large number of users.
Authorization is the process of determining what a user is allowed to do. Different user accounts may
have higher or lower privilege levels associated with them. For example, user A may have the right to
create new login accounts on the system but user B cannot. The system can authorize users based on
user accounts configured on the system itself or it can use an external server to authorize a large
number of users.
Accounting is the process of recording what a user is doing. The system can use an external server to
track when users log in, log out, execute commands and so on. Accounting can also record system
related actions such as boot up and shut down times of the system.
The external servers that perform authentication, authorization and accounting functions are known as
AAA servers. The system supports RADIUS (Remote Authentication Dial-In User Service) and
(Terminal Access Controller Access-Control System Plus) as external authentication and accounting
servers. The system supports as external authorization server only.
Local User Accounts
By storing user profiles locally on the OLT, your OLT is able to authenticate and authorize users without
interacting with a network authentication server. However, there is a limit on the number of users you
may authenticate in this way.
RADIUS and
RADIUS and are security protocols used to authenticate users by means of an external server
instead of (or in addition to) an internal device user database that is limited to the memory capacity of
the device. In essence, RADIUS and authentication both allow you to validate an unlimited
number of users from a central location.