This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
aaa [2012/08/29 11:34] val |
aaa [2020/04/23 15:59] val [Локальная авторизация] |
||
---|---|---|---|
Line 37: | Line 37: | ||
login authentication CONSOLE | login authentication CONSOLE | ||
authorization exec CONSOLE | authorization exec CONSOLE | ||
+ | privilege level 15 | ||
</code> | </code> | ||
Line 47: | Line 48: | ||
==== Локальная авторизация ==== | ==== Локальная авторизация ==== | ||
+ | |||
+ | * [[https://www.cisco.com/c/en/us/support/docs/routers/asr-1000-series-aggregation-services-routers/212149-Configure-IOS-XE-to-display-full-show-ru.html|Configure IOS-XE to display full show running-config for users with low Privilege Levels]] | ||
Уровни привилегий: | Уровни привилегий: | ||
- | * 1 - минимальный | + | * 0 - минимальный |
+ | * 1-14 - можно назначить разрешения | ||
* 15 - максимальный | * 15 - максимальный | ||
Line 57: | Line 61: | ||
username user1 privilege 7 | username user1 privilege 7 | ||
- | privilege exec level 7 show running-config | + | privilege exec level 7 show running-config view full |
- | ???? выводит пустую конфигурацию ???? | + | |
- | + | ||
- | username user1 privilege 15 | + | |
</code><code> | </code><code> | ||
- | server# telnet switch | + | server# ssh user1@switch1 |
... | ... | ||
switch# show privilege | switch# show privilege | ||
+ | |||
+ | switch# show running-config view full | ||
... | ... | ||
</code> | </code> | ||
Line 83: | Line 86: | ||
aaa authorization exec default local none | aaa authorization exec default local none | ||
</code> | </code> | ||
+ | |||
+ | === Использование RADIUS для авторизации telnet подключений ===== | ||
+ | <code> | ||
+ | aaa authorization exec default group radius none | ||
+ | </code> | ||
+ | |||
=== Использование RADIUS для протокола 802.1x ===== | === Использование RADIUS для протокола 802.1x ===== | ||
+ | |||
+ | [[http://open1x.sourceforge.net/]] | ||
+ | |||
<code> | <code> | ||
aaa authentication dot1x default group radius | aaa authentication dot1x default group radius | ||
Line 90: | Line 102: | ||
aaa accounting dot1x default start-stop group radius | aaa accounting dot1x default start-stop group radius | ||
</code> | </code> | ||
+ | ==== Аутентификация и авторизация с использованием TACACS+ ==== | ||
+ | |||
+ | === Настройка клиента TACACS+ === | ||
+ | <code> | ||
+ | tacacs-server host server | ||
+ | |||
+ | tacacs-server key tackey123 | ||
+ | </code> | ||
+ | |||
+ | === Использование TACACS+ для аутентификации telnet подключений === | ||
+ | <code> | ||
+ | aaa authentication login default group tacacs+ enable | ||
+ | |||
+ | aaa authorization exec default group tacacs+ none | ||
+ | |||
+ | aaa accounting commands 15 default start-stop group tacacs+ | ||
+ | </code> | ||
+ | |||
+ | ===== Дополнительные материалы ===== | ||
+ | |||
+ | * [[http://ciscomaster.ru/content/access-delegate-rbac|Делегирование прав доступа к консоли или Role-Based Access Control (RBAC)]] | ||
+ | * [[http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gtclivws.html|Role-Based CLI Access]] | ||
+ |