HP 6125G HP 6125G & 6125G/XG Blade Switches Fundamentals Configuration - Page 47

level, Security Configuration Guide, command

Get HP 6125G PDF manuals and user guides View all HP 6125G manuals
Add to My Manuals
Save this manual to your list of manuals

Page 47 highlights

• To make the command authorization or command accounting function take effect, apply an HWTACACS scheme to the intended ISP domain. This scheme must specify the IP address of the authorization server and other authorization parameters. • If the local authentication scheme is used, use the authorization-attribute level level command in local user view to set the user privilege level on the device. • If a RADIUS or HWTACACS authentication scheme is used, set the user privilege level on the RADIUS or HWTACACS server. The SSH client authentication method is password in this configuration procedure. For more information about SSH and publickey authentication, see Security Configuration Guide. To configure the SSH server on the device: Step 1. Enter system view. 2. Create local key pairs. 3. Enable SSH server. 4. Enter one or more VTY user interface views. 5. Enable scheme authentication. 6. Enable the user interfaces to support Telnet, SSH, or both of them. 7. Enable command authorization. Command Remarks system-view N/A public-key local create { dsa | rsa } By default, no local key pairs are created. ssh server enable By default, SSH server is disabled. user-interface vty first-number [ last-number ] N/A authentication-mode scheme By default, password authentication is enabled on VTY user interfaces. protocol inbound { all | ssh | telnet } Optional. By default, both Telnet and SSH are supported. command authorization Optional. By default, command authorization is disabled. The commands available for a user only depend on the user privilege level. If command authorization is enabled, a command is available only if the user has the commensurate user privilege level and is authorized to use the command by the AAA scheme. 41

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
41
•
To make the command authorization or command accounting function take effect, apply an
HWTACACS scheme to the intended ISP domain. This scheme must specify the IP address of the
authorization server and other authorization parameters.
•
If the local authentication scheme is used, use the
authorization-attribute level
level
command in
local user view to set the user privilege level on the device.
•
If a RADIUS or HWTACACS authentication scheme is used, set the user privilege level on the
RADIUS or HWTACACS server.
The SSH client authentication method is password in this configuration procedure. For more information
about SSH and publickey authentication, see
Security Configuration Guide
.
To configure the SSH server on the device:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Create local key pairs.
public-key local create
{
dsa
|
rsa
}
By default, no local key pairs are
created.
3.
Enable SSH server.
ssh server enable
By default, SSH server is disabled.
4.
Enter one or more VTY user
interface views.
user-interface vty
first
-
number
[
last-number
]
N/A
5.
Enable scheme
authentication.
authentication-mode scheme
By default, password
authentication is enabled on VTY
user interfaces.
6.
Enable the user interfaces to
support Telnet, SSH, or both
of them.
protocol inbound
{
all
|
ssh
|
telnet
}
Optional.
By default, both Telnet and SSH
are supported.
7.
Enable command
authorization.
command authorization
Optional.
By default, command authorization
is disabled. The commands
available for a user only depend
on the user privilege level.
If command authorization is
enabled, a command is available
only if the user has the
commensurate user privilege level
and is authorized to use the
command by the AAA scheme.