Dell Brocade G620 Brocade 8.0.1 Fabric OS Administratiors Guide - Page 181

Managing User Accounts TABLE 28 Brocade custom TACACS+ attributes Attribute brcd-role brcd-AV-Pair1 brcd-AV-Pair2 brcd-passwd-expiryDate brcd-passwd-warnPeriod Purpose Role assigned to the user account The Virtual Fabric member list, and chassis role The Virtual Fabric member list, and chassis role The date on which the password expires The time before expiration for the user to receive a warning message Adding a user and assigning a role When adding a user to the tac_plus.cfg file, you should at least provide the brcd-role attribute. The value assigned to this attribute should match a role defined for the switch. When a login is authenticated, the role specified by the brcd-role attribute represents the permissions granted to the account. If no role is specified, or if the specified role does not exist on the switch, the account is granted user role permissions only. Refer to Role-Based Access Control on page 145 for details about roles. The following fragment from a tac_plus.cfg file adds a user named fosuser1 and assigns the securityAdmin role to the account. user = fosuser1 { chap = cleartext "my$chap$pswrd" pap = cleartext "pap-password" service = exec { brcd-role = securityAdmin; } } Configuring Virtual Fabric lists If your network uses Virtual Fabrics, you should create Virtual Fabric lists for each user to identify the Virtual Fabrics to which the account has access. Assign the following key-value pairs to the brcd-AV--Pair1 and, optionally, brcd-AV-Pair2 attributes to grant the account access to the Virtual Fabrics: ∙ HomeLF is the designated home Virtual Fabric for the account. The valid values are from 1 through 128 and chassis context. The first valid HomeLF key-value pair is accepted by the switch. Additional HomeLF key-value pairs are ignored. ∙ LFRoleList is a comma-separated list of Virtual Fabric ID numbers to which this account is a member, and specifies the role the account has on those Virtual Fabrics. Valid numbers range from 1 through 128. A - between two numbers specifies a range. The following example sets the home Virtual Fabric for the userVF account to 30 and allows the account admin role access to Virtual Fabrics 1, 3, and 4 and securityAdmin access to Virtual Fabrics 5 and 6. user = userVF { pap = clear "password" service = shell { set brcd-role = zoneAdmin set brcd-AV-Pair1 = "homeLF=30;LFRoleList=admin:1,3,4;securityAdmin:5,6" set brcd-AV-Pair2 = "chassisRole=admin" } } Configuring the password expiration date FabricOS allows you to configure a password expiration date for each user account and to configure a warning period for notifying the user that the account password is about to expire. To configure these values, set the following attributes: ∙ brcd-passwd-expiryDate sets the password expiration date in mm/dd/yyyy format. Brocade Fabric OS Administration Guide, 8.0.1 53-1004111-02 181