Cisco AS5800 Specifications download pdf (Page 166)

4-28

Cisco AS5800 Operations, Administration, Maintenance, and Provisioning Guide

DOC-7810814=

Chapter 4 Administration

Access Service Security

Configuring Authentication on a TACACS+ Server

On most TACACS+ security servers, there are three ways to authenticate a user for login:

• Include a cleartext (DES) password for a user or for a users group (each user can belong to only one

group). Note that CHAP and global user authentication must be specified in cleartext.

The following is the configuration for global authentication:

user = birdman {global = cleartext “birdman global password”}

To assign different passwords for CHAP, and a normal login, you must enter a string for each user.

Each string must specify the security protocols, state whether the password is cleartext, and specify

if the authentication is performed with a DES card. The following example shows a user aaaa, who

has authentication configured for CHAP and login. The users CHAP password, “chap password,” is

shown in cleartext and the login password has been encrypted.

user = aaaa

chap = cleartext “chap password”

• Use password (5) files instead of entering the password into the configuration file directly.

The default authentication is to deny authentication. You can change this at the top level of the

configuration file to have the default use passwd(5) file, by issuing the following command:

default authentication = /etc/passwd

• Authenticate using an s/key. If you have built and linked in an s/key library and compiled

TACACS+ to use the s/key, you can specify that a user be authenticated using the s/key, as shown

in the following example:

user= bbbb {login = skey}

On the Cisco AS5800, configure authentication on all lines including the VTY and Console lines by

entering the following commands:

5800-1# configure terminal

5800-1(config)# aaa new-model

5800-1(config)# aaa authentication login default tacacs+ enable

Caution When you issue the aaa authentication login default tacacs+ enable command, you are

specifying that if your TACACS+ server fails to respond (because it is set up incorrectly),

you can log in to the Cisco AS5800 by using your enable password. If you do not have an

enable password set on the Cisco AS5800, you will not be able to log in until you have a

functioning TACACS+ daemon configured with user names and passwords. The enable

password in this case is a last-resort authentication method. You can also specify none as

the last-resort method, which means that no authentication is required if all other methods

have failed.

1 2 ... 161 162 163 164 165 166 167 168 169 170 171 ... 333 334

No comments

Cisco AS5800 Specifications Page 166