HP GbE2c HP GbE2c Ethernet Blade Switch for c-Class BladeSystem Application Gu - Page 22

How TACACS+ authentication works, TACACS+ authentication features, Authorization, Table 4 - manual

Get HP GbE2c - Blc Layer 2/3 Fiber SFP Option PDF manuals and user guides
UPC - 808736802215
View all HP GbE2c manuals
Add to My Manuals
Save this manual to your list of manuals

Page 22 highlights

• TACACS+ offers full packet encryption whereas RADIUS offers password-only encryption in authentication requests. • TACACS+ separates authentication, authorization, and accounting. How TACACS+ authentication works TACACS+ works much in the same way as RADIUS authentication. 1. Remote administrator connects to the switch and provides user name and password. NOTE: The user name and password can have a maximum length of 128 characters. The password cannot be left blank. 2. Using Authentication/Authorization protocol, the switch sends request to authentication server. 3. Authentication server checks the request against the user ID database. 4. Using TACACS+ protocol, the authentication server instructs the switch to grant or deny administrative access. During a session, if additional authorization checking is needed, the switch checks with a TACACS+ server to determine if the user is granted permission to use a particular command. TACACS+ authentication features Authentication is the action of determining the identity of a user, and is generally done when the user first attempts to log in to a device or gain access to its services. Switch software supports ASCII inbound login to the device. PAP, CHAP and ARAP login methods, TACACS+ change password requests, and one-time password authentication are not supported. Authorization Authorization is the action of determining a user's privileges on the device, and usually takes place after authentication. The default mapping between TACACS+ authorization privilege levels and switch management access levels is shown in the table below. The privilege levels listed in the following table must be defined on the TACACS+ server. Table 4 Default TACACS+ privilege levels User access level TACACS+ level user 0 oper 3 admin 6 Alternate mapping between TACACS+ privilege levels and GbE2c management access levels is shown in the table below. Use the command /cfg/sys/tacacs/cmap ena to use the alternate TACACS+ privilege levels. Table 5 Alternate TACACS+ privilege levels User access level TACACS+ level user oper admin 0-1 6- 8 14-15 You can customize the mapping between TACACS+ privilege levels and GbE2c management access levels. Use the command /cfg/sys/tacacs/usermap to manually map each TACACS+ privilege level (0-15) to a corresponding GbE2c management access level (user, oper, admin, none). If the remote user is authenticated by the authentication server, the GbE2c verifies the privileges of the remote user and authorizes the appropriate access. When both the primary and secondary authentication servers are not reachable, the administrator has an option to allow backdoor access via the console only or console and Telnet access. The default value is disable for Telnet access and enable for console access. The administrator also can enable secure backdoor (/cfg/sys/tacacs/secbd) to allow access if both the primary and secondary TACACS+ servers fail to respond. Accessing the switch 22

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
Accessing the switch 22
•
TACACS+ offers full packet encryption whereas RADIUS offers password-only encryption in authentication
requests.
•
TACACS+ separates authentication, authorization, and accounting.
How TACACS+ authentication works
TACACS+ works much in the same way as RADIUS authentication.
1.
Remote administrator connects to the switch and provides user name and password.
NOTE:
The user name and password can have a maximum length of 128 characters. The password
cannot be left blank.
2.
Using Authentication/Authorization protocol, the switch sends request to authentication server.
3.
Authentication server checks the request against the user ID database.
4.
Using TACACS+ protocol, the authentication server instructs the switch to grant or deny administrative access.
During a session, if additional authorization checking is needed, the switch checks with a TACACS+ server to
determine if the user is granted permission to use a particular command.
TACACS+ authentication features
Authentication is the action of determining the identity of a user, and is generally done when the user first attempts to
log in to a device or gain access to its services. Switch software supports ASCII inbound login to the device. PAP,
CHAP and ARAP login methods, TACACS+ change password requests, and one-time password authentication are not
supported.
Authorization
Authorization is the action of determining a user’s privileges on the device, and usually takes place after
authentication.
The default mapping between TACACS+ authorization privilege levels and switch management access levels is
shown in the table below. The privilege levels listed in the following table must be defined on the TACACS+ server.
Table 4
Default TACACS+ privilege levels
User access level
TACACS+ level
user
0
oper
3
admin
6
Alternate mapping between TACACS+ privilege levels and GbE2c management access levels is shown in the table
below. Use the command
/cfg/sys/tacacs/cmap ena
to use the alternate TACACS+ privilege levels.
Table 5
Alternate TACACS+ privilege levels
User access level
TACACS+ level
user
0—1
oper
6— 8
admin
14—15
You can customize the mapping between TACACS+ privilege levels and GbE2c management access levels. Use the
command
/cfg/sys/tacacs/usermap
to manually map each TACACS+ privilege level (0-15) to a corresponding
GbE2c management access level (user, oper, admin, none).
If the remote user is authenticated by the authentication server, the GbE2c verifies the
privileges
of the remote user
and authorizes the appropriate access. When both the primary and secondary authentication servers are not
reachable, the administrator has an option to allow
backdoor
access via the console only or console and Telnet
access. The default value is
disable
for Telnet access and
enable
for console access. The administrator also can
enable
secure backdoor
(/cfg/sys/tacacs/secbd) to allow access if both the primary and secondary TACACS+
servers fail to respond.