HP GbE2c HP GbE2c Layer 2/3 Ethernet Blade Switch for c-Class BladeSystem User - Page 13

TACACS, SSH and SCP, XModem - management login

Get HP GbE2c - Blc Layer 2/3 Fiber SFP Option PDF manuals and user guides
UPC - 808736802215
View all HP GbE2c manuals
Add to My Manuals
Save this manual to your list of manuals

Page 13 highlights

• Identification of the administrator using name/password • Authorization of remote administrators • Determination of the permitted actions and customizing service for individual administrators TACACS+ The switch supports the TACACS+ method to authenticate, authorize, and account for remote administrators managing the switch. This method is based on a client/server model. The switch is a client to the back-end TACACS+ AAA server. A remote user (the remote administrator) interacts only with the client, and not with the back end AAA server. The TACACS+ AAA method consists of: • A protocol with a frame format that utilizes TCP over IP • A centralized AAA server that stores all the user authentication, authorization, and accounting (of usage) information • A NAS or client (in this case, the switch) The switch, acting as the TACACS+ client or NAS, communicates to the TACACS+ server to authenticate, authorize, and account for user access. Transactions between the client and the TACACS+ server are authenticated using a shared key that is not sent over the network. In addition, the remote administrator passwords are sent encrypted between the TACACS+ client (the switch) and the back-end TACACS+ server. The switch supports: • Only standard ASCII inbound login authentication. PAP, CHAP, or ARAP login methods are not supported. One-time password authentication is also not supported. • Authorization privilege levels of only 0, 3, and 6. These map to management levels of user, oper, and admin, respectively. • The accounting attributes of protocol, start_time, stop_time, and elapsed_time. For BBI users, accounting stop records are only sent if the user presses the QUIT button. SSH and SCP SSH and SCP use secure tunnels to encrypt and secure messages between a remote administrator and the switch. Telnet does not provide this level of security. The Telnet method of managing a switch does not provide a secure connection. SSH is a protocol that enables remote administrators to log securely into the switch over a network to execute management commands. SCP is used to copy files securely from one machine to another. SCP uses SSH for encryption of data on the network. On a switch, SCP is used to download and upload the switch configuration via secure channels. XModem The switch supports XModem for transferring files during direct dial-up communications. XModem sends blocks of data in 128-byte blocks, and includes an error-detection system called a checksum. When the data is received, the error detection system ensures that the entire message reached its destination. If not, the receiving computer sends a request for retransmission of the data. Introduction 13

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
Introduction 13
•
Identification of the administrator using name/password
•
Authorization of remote administrators
•
Determination of the permitted actions and customizing service for individual administrators
TACACS+
The switch supports the TACACS+ method to authenticate, authorize, and account for remote
administrators managing the switch. This method is based on a client/server model. The switch is a client
to the back-end TACACS+ AAA server. A remote user (the remote administrator) interacts only with the
client, and not with the back end AAA server.
The TACACS+ AAA method consists of:
•
A protocol with a frame format that utilizes TCP over IP
•
A centralized AAA server that stores all the user authentication, authorization, and accounting (of
usage) information
•
A NAS or client (in this case, the switch)
The switch, acting as the TACACS+ client or NAS, communicates to the TACACS+ server to authenticate,
authorize, and account for user access. Transactions between the client and the TACACS+ server are
authenticated using a shared key that is not sent over the network. In addition, the remote administrator
passwords are sent encrypted between the TACACS+ client (the switch) and the back-end TACACS+
server.
The switch supports:
•
Only standard ASCII inbound login authentication. PAP, CHAP, or ARAP login methods are not
supported. One-time password authentication is also not supported.
•
Authorization privilege levels of only 0, 3, and 6. These map to management levels of user, oper,
and admin, respectively.
•
The accounting attributes of protocol, start_time, stop_time, and elapsed_time. For BBI users,
accounting stop records are only sent if the user presses the QUIT button.
SSH and SCP
SSH and SCP use secure tunnels to encrypt and secure messages between a remote administrator and the
switch. Telnet does not provide this level of security. The Telnet method of managing a switch does not
provide a secure connection.
SSH is a protocol that enables remote administrators to log securely into the switch over a network to
execute management commands.
SCP is used to copy files securely from one machine to another. SCP uses SSH for encryption of data on
the network. On a switch, SCP is used to download and upload the switch configuration via secure
channels.
XModem
The switch supports XModem for transferring files during direct dial-up communications. XModem sends
blocks of data in 128-byte blocks, and includes an error-detection system called a checksum. When the
data is received, the error detection system ensures that the entire message reached its destination. If not,
the receiving computer sends a request for retransmission of the data.