История страницы

esrvesbc(config)# aaa accounting commands stop-only tacacs

esrvesbc(config)# aaa accounting login start-stop tacacs

esrvesbc(config)# aaa authentication attempts max-fail 5 30

esrvesbc(config)# aaa authentication enable enable-test tacacs enable

esrvesbc(config)# aaa authentication login login-test tacacs local

esrvesbc(config)# aaa authentication mode break

esrvesbc(config)# aaa authorization commands

esrvesbc(config)# aaa authorization control-commands enable

esrvesbc(config)# aaa authorization mode break

esrvesbc(config)# aaa das-profile profile1
esrvesbc(config-aaa-das-profile)#

esrvesbc(config-line-console)# aaa disable

esrvesbc(config)# aaa radius-profile profile1
esrvesbc(config-aaa-radius-profile)#

esrvesbc(config-radius-server)# acct-port 4444

esrvesbc(config-radius-server)# auth-port 4444

esr#vesbc# clear users-session

esrvesbc(config-das-server)# clients object-group pcrf

esrvesbc(config-line-ssh)# commands authorization authorization-test

esrvesbc(config)# das-server main
esrvesbc(config-das-server)#

esrvesbc(config)# das-server mainesrmainvesbc(config-das-server)#

esrvesbc(config-radius-server)# dead-interval 600

esrvesbc(config-aaa-das-profile)# description "Main profile"

esrvesbc(config-radius-server)# description "Main server"

esr#vesbc# disable
esr>vesb>

esr>vesbc> enable 10 
esr#vesbc#

esrvesbc(config-line-console)# enable authentication enable-test

esrvesbc(config)# enable password 12345678 privilege 10

esrvesbc(config-line-ssh)# exec-timeout 600

esrvesbc(config-user)# ip sftp enable

esrvesbc(config-tacacs-server)# key ascii-text 12345678

esrvesbc(config)# ldap-server base-dn “dc=example,dc=com”

esrvesbc(config)# ldap-server bind authenticate root-dn “cn=admin,dc=example,dc=com”

esrvesbc(config)# ldap-server bind authenticate root-password ascii-text 12345678

esrvesbc(config)# ldap-server bind timeout 5

esrvesbc(config)# ldap-server dscp 40

esrvesbc(config)# ldap-server host 10.100.100.1
esrvesbc(config-ldap-server)#

esrvesbc(config)# ldap-server naming-attribute displayName

esrvesbc(config)# ldap-server privilege-level-attribute title

esrvesbc(config)# ldap-server search filter user-object-class shadowAccount

esrvesbc(config)# ldap-server search scope onelevel

esrvesbc(config)# ldap-server search timeout 10

esrvesbc(config)# ldap-server ssl crypto ldap-ssl.crt

esrvesbc(config)# ldap-server ssl check-peer disable

esrvesbc(config)# ldap-server ssl enable  

esrvesbc(config)# line console
esrvesbc(config-line-console)#

esrvesbc(config-line-console)# login authentication login-test

esrvesbc(config-user) password test

esrvesbc(config-tacacs-server)# port 4444

esrvesbc(config-tacacs-server)# priority 5

esrvesbc(config-user)# privilege 15

esrvesbc(config)# privilege root level 2 "show"
esrvesbc(config)# privilege root level 1 "show interfaces"

esrvesbc(config)# radius-server dscp 40

esrvesbc(config)# radius-server host 10.100.100.1
esrvesbc(config-radius-server)#

esrvesbc(config-aaa-radius-profile)# radius-server host 10.100.100.1

esrvesbc(config)# radius-server retransmit 5

esrvesbc(config)# radius-server timeout 5

esrvesbc(config)# retransmit 5

esrvesbc(config)# security passwords default-expired

esrvesbc(config)# security passwords history 5

esrvesbc(config)# security passwords lifetime 30

esrvesbc(config)# security passwords lower-case 2

esrvesbc(config)# security passwords max-length 30

esrvesbc(config)# security passwords min-length 10

esrvesbc(config)# security passwords numeric-count 2

esrvesbc(config)# security passwords special-case 2

esrvesbc(config)# security passwords symbol-types 2

esrvesbc(config)# security passwords upper-case 2

esrvesbc(config)# security snmp-community max-length 30

esrvesbc(config)# security snmp-community min-length 10

esr#vesbc# show aaa accounting
Login :          radius
Commands :       tacacs

esr#vesbc# show aaa authentication
   Login Authentication Method Lists
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
List               Methods
----------------   --------------------------------
default            local
   Enable Authentication Method Lists
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
List               Methods
----------------   --------------------------------
default            enable
   Lines configuration
   ~~~~~~~~~~~~~~~~~~~
Line        Login method list                  Enable method list
---------   --------------------------------   --------------------------------
console     default                            default
telnet      default                            default
ssh         default                            default

esr#vesbc# show aaa ldap-servers
Base DN:                      dc=example,dc=com
Root DN:                      cn=admin,dc=example,dc=com
Root password:                CDE65039E5591FA3
Naming attribute:             uid
Privilege level attribute:    priv-lvl
User object class:            posixAccount
DSCP:                         63
Bind timeout:                 3
Search timeout:               0
Search scope:                 subtree
IP Address                         Port           Priority
--------------------------------   ------------   ------------
10.100.100.1                       389            1

esr#vesbc# show aaa radius-servers
Timeout:     3
Retransmit:  1
DSCP:        63
IP Addres        Timeout      Priority     Usage        Key
------------    ----------   ----------   ----------   ---------------------------
2.2.2.2             --           1            all          9DA7076CA30B5FFE0DC9C4
2.4.4.4             --           1            all          9DA7076BA30B4EFCE5

esr#vesbc# show aaa tacacs-servers
Timeout :       3
DSCP:          63
IP Address               Port           Priority       Key
----------------------   ------------   ------------   --------------------------------
10.100.100.1             49             1              CDE65039E5591FA3
10.100.100.5             49             10             CDE65039E5591FA3

esr#vesbc# show users 
SID    User name    Logged in at          Protocol    Host            Timers Login/Priv   Level   
----   ----------   -----------------     ---------   -------------   -----------------   -----
0 *    admin        2023-06-26 15:47:38   SSH         192.168.1.44    00:29:59/00:00:00   15    
1      admin        2023-06-26 15:47:38   Telnet      192.168.1.44    00:25:08/00:00:00   15   
2      admin        2023-06-26 15:47:38   Console     Console         00:29:56/00:00:00   15

esr#vesbc# show user accounts
Name                               Password                           Privilege
--------------------------------   --------------------------------   ---------
admin                              $6$1sxrvGaV8Za8oX/K$YNel5xYPZ4cj   15
                                   bemYWYNpQBQKDxWE9v0aoKgQ
                                   kRCEb0EMNuusO9Kmg7UBs7nA3buEM87e
                                   Eu.rA6tZq0
techsupport                        $6$YfwntIwU$ah7UxPZTemKhjpSWvVsV   15
                                   9jHcp. 9lweQaSldw7ZtUr
                                   uH66uZx9.EBASff//hUj8ObUaC484TNR
                                   x.
remote                             $6$YfwntIwU$ah7UxPZTemKhjpSWvVsV   1
                                   9jHcp.kqFAK.vmvyY9lweQaSldw7ZtUr
                                   uH66uZx9.EBASff//hUj8ObUaC484TNR
                                   x.
operator                           $6$eILpbbyRxedCzvVD$4RHP08mjXvNf   1
                                   urX7V/ULCZ1oHIWMwE6h5f
                                   zgwZQUZcPoZCEyaqQQqCicRMRuPwhxrQ
                                   bvGChWreW1

esr#vesbc# show users blocked
User name              Failures   Latest failure        From
--------------------   --------   -------------------   ----------------
tester                 4          2017-09-10 08:29:42   0.0.0.0

esrvesbc(config-radius-server)# source-address 220::71

esrvesbc(config-radius-server)# source-interface gigabitethernet 1/0/1

esrvesbc(config)# system configuration-exclusively

esrvesbc(config)# tacacs-server dscp 40

esrvesbc(config)# tacacs-server host 10.100.100.1
esrvesbc(config-tacacs-server)#

esrvesbc(config)# tacacs-server timeout 5

esrvesbc(config)# tech-support login enable

esrvesbc(config-radius-server)# timeout 7

esrvesbc(config-radius-server)# usage pptp

esrvesbc(config)# username test
esrvesbc(config-user)#