История страницы

vesbcesr(config)# aaa accounting commands stop-only tacacs

vesbcesr(config)# aaa accounting login start-stop tacacs

vesbcesr(config)# aaa authentication attempts max-fail 5 30

vesbcesr(config)# aaa authentication enable enable-test tacacs enable

vesbcesr(config)# aaa authentication login login-test tacacs local

vesbcesr(config)# aaa authentication mode break

vesbcesr(config)# aaa authorization commands

vesbcesr(config)# aaa authorization control-commands enable

vesbcesr(config)# aaa authorization mode break

vesbcesr(config)# aaa das-profile profile1
vesbcesr(config-aaa-das-profile)#

vesbcesr(config-line-console)# aaa disable

vesbcesr(config)# aaa radius-profile profile1
vesbcesr(config-aaa-radius-profile)#

vesbcesr(config-radius-server)# acct-port 4444

vesbcesr(config-radius-server)# auth-port 4444

vesbc#esr# clear users-session

vesbcesr(config-das-server)# clients object-group pcrf

vesbcesr(config-line-ssh)# commands authorization authorization-test

vesbcesr(config)# das-server main
vesbcesr(config-das-server)#

vesbcesr(config)# das-server mainvesbcmainesr(config-das-server)#

vesbcesr(config-radius-server)# dead-interval 600

vesbcesr(config-aaa-das-profile)# description "Main profile"

vesbcesr(config-radius-server)# description "Main server"

vesbc#esr# disable
vesb>esr>

vesbc>esr> enable 10 
vesbc#esr#

vesbcesr(config-line-console)# enable authentication enable-test

vesbcesr(config)# enable password 12345678 privilege 10

vesbcesr(config-line-ssh)# exec-timeout 600

vesbcesr(config-user)# ip sftp enable

vesbcesr(config-tacacs-server)# key ascii-text 12345678

vesbcesr(config)# ldap-server base-dn “dc=example,dc=com”

vesbcesr(config)# ldap-server bind authenticate root-dn “cn=admin,dc=example,dc=com”

vesbcesr(config)# ldap-server bind authenticate root-password ascii-text 12345678

vesbcesr(config)# ldap-server bind timeout 5

vesbcesr(config)# ldap-server dscp 40

vesbcesr(config)# ldap-server host 10.100.100.1
vesbcesr(config-ldap-server)#

vesbcesr(config)# ldap-server naming-attribute displayName

vesbcesr(config)# ldap-server privilege-level-attribute title

vesbcesr(config)# ldap-server search filter user-object-class shadowAccount

vesbcesr(config)# ldap-server search scope onelevel

vesbcesr(config)# ldap-server search timeout 10

vesbcesr(config)# ldap-server ssl crypto ldap-ssl.crt

vesbcesr(config)# ldap-server ssl check-peer disable

vesbcesr(config)# ldap-server ssl enable  

vesbcesr(config)# line console
vesbcesr(config-line-console)#

vesbcesr(config-line-console)# login authentication login-test

vesbcesr(config-user) password test

vesbcesr(config-tacacs-server)# port 4444

vesbcesr(config-tacacs-server)# priority 5

vesbcesr(config-user)# privilege 15

vesbcesr(config)# privilege root level 2 "show"
vesbcesr(config)# privilege root level 1 "show interfaces"

vesbcesr(config)# radius-server dscp 40

vesbcesr(config)# radius-server host 10.100.100.1
vesbcesr(config-radius-server)#

vesbcesr(config-aaa-radius-profile)# radius-server host 10.100.100.1

vesbcesr(config)# radius-server retransmit 5

vesbcesr(config)# radius-server timeout 5

vesbcesr(config)# retransmit 5

vesbcesr(config)# security passwords default-expired

vesbcesr(config)# security passwords history 5

vesbcesr(config)# security passwords lifetime 30

vesbcesr(config)# security passwords lower-case 2

vesbcesr(config)# security passwords max-length 30

vesbcesr(config)# security passwords min-length 10

vesbcesr(config)# security passwords numeric-count 2

vesbcesr(config)# security passwords special-case 2

vesbcesr(config)# security passwords symbol-types 2

vesbcesr(config)# security passwords upper-case 2

vesbcesr(config)# security snmp-community max-length 30

vesbcesr(config)# security snmp-community min-length 10

vesbc#esr# show aaa accounting
Login :          radius
Commands :       tacacs

vesbc#esr# show aaa authentication
   Login Authentication Method Lists
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
List               Methods
----------------   --------------------------------
default            local
   Enable Authentication Method Lists
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
List               Methods
----------------   --------------------------------
default            enable
   Lines configuration
   ~~~~~~~~~~~~~~~~~~~
Line        Login method list                  Enable method list
---------   --------------------------------   --------------------------------
console     default                            default
telnet      default                            default
ssh         default                            default

vesbc#esr# show aaa ldap-servers
Base DN:                      dc=example,dc=com
Root DN:                      cn=admin,dc=example,dc=com
Root password:                CDE65039E5591FA3
Naming attribute:             uid
Privilege level attribute:    priv-lvl
User object class:            posixAccount
DSCP:                         63
Bind timeout:                 3
Search timeout:               0
Search scope:                 subtree
IP Address                         Port           Priority
--------------------------------   ------------   ------------
10.100.100.1                       389            1

vesbc#esr# show aaa radius-servers
Timeout:     3
Retransmit:  1
DSCP:        63
IP Addres        Timeout      Priority     Usage        Key
------------    ----------   ----------   ----------   ---------------------------
2.2.2.2             --           1            all          9DA7076CA30B5FFE0DC9C4
2.4.4.4             --           1            all          9DA7076BA30B4EFCE5

vesbc#esr# show aaa tacacs-servers
Timeout :       3
DSCP:          63
IP Address               Port           Priority       Key
----------------------   ------------   ------------   --------------------------------
10.100.100.1             49             1              CDE65039E5591FA3
10.100.100.5             49             10             CDE65039E5591FA3

vesbc#esr# show users 
SID    User name    Logged in at          Protocol    Host            Timers Login/Priv   Level   
----   ----------   -----------------     ---------   -------------   -----------------   -----
0 *    admin        2023-06-26 15:47:38   SSH         192.168.1.44    00:29:59/00:00:00   15    
1      admin        2023-06-26 15:47:38   Telnet      192.168.1.44    00:25:08/00:00:00   15   
2      admin        2023-06-26 15:47:38   Console     Console         00:29:56/00:00:00   15

vesbc#esr# show user accounts
Name                               Password                           Privilege
--------------------------------   --------------------------------   ---------
admin                              $6$1sxrvGaV8Za8oX/K$YNel5xYPZ4cj   15
                                   bemYWYNpQBQKDxWE9v0aoKgQ
                                   kRCEb0EMNuusO9Kmg7UBs7nA3buEM87e
                                   Eu.rA6tZq0
techsupport                        $6$YfwntIwU$ah7UxPZTemKhjpSWvVsV   15
                                   9jHcp. 9lweQaSldw7ZtUr
                                   uH66uZx9.EBASff//hUj8ObUaC484TNR
                                   x.
remote                             $6$YfwntIwU$ah7UxPZTemKhjpSWvVsV   1
                                   9jHcp.kqFAK.vmvyY9lweQaSldw7ZtUr
                                   uH66uZx9.EBASff//hUj8ObUaC484TNR
                                   x.
operator                           $6$eILpbbyRxedCzvVD$4RHP08mjXvNf   1
                                   urX7V/ULCZ1oHIWMwE6h5f
                                   zgwZQUZcPoZCEyaqQQqCicRMRuPwhxrQ
                                   bvGChWreW1

vesbc#esr# show users blocked
User name              Failures   Latest failure        From
--------------------   --------   -------------------   ----------------
tester                 4          2017-09-10 08:29:42   0.0.0.0

vesbcesr(config-radius-server)# source-address 220::71

vesbcesr(config-radius-server)# source-interface gigabitethernet 1/0/1

vesbcesr(config)# system configuration-exclusively

vesbcesr(config)# tacacs-server dscp 40

vesbcesr(config)# tacacs-server host 10.100.100.1
vesbcesr(config-tacacs-server)#

vesbcesr(config)# tacacs-server timeout 5

vesbcesr(config)# tech-support login enable

vesbcesr(config-radius-server)# timeout 7

vesbcesr(config-radius-server)# usage pptp

vesbcesr(config)# username test
vesbcesr(config-user)#