HP ProCurve 9304M Security Manual page 37

NOTE: TACACS+ provides for authentication, authorization, and accounting, but an implementation or
configuration is not required to employ all three.
TACACS/TACACS+ Authentication, Authorization, and Accounting
When you configure an HP device to use a TACACS/TACACS+ server for authentication, the device prompts users
who are trying to access the CLI for a user name and password, then verifies the password with the TACACS/
TACACS+ server.
If you are using TACACS+, HP recommends that you also configure authorization, in which the HP device
consults a TACACS+ server to determine which management privilege level (and which associated set of
commands) an authenticated user is allowed to use. You can also optionally configure accounting, which causes
the HP device to log information on the TACACS+ server when specified events occur on the device.
NOTE: By default, a user logging into the device via Telnet or SSH would first enter the User EXEC level. The
user can enter the enable command to get to the Privileged EXEC level.
Starting with release 07.1.08, a user that is successfully authenticated can be automatically placed at the
Privileged EXEC level after login. See "Entering Privileged EXEC Mode After a Telnet or SSH Login" on page 2­
28.
TACACS Authentication
When TACACS authentication takes place, the following events occur:
1. A user attempts to gain access to the HP device by doing one of the following:
• Logging into the device using Telnet, SSH, or the Web management interface
• Entering the Privileged EXEC level or CONFIG level of the CLI
2. The user is prompted for a username and password.
3. The user enters a username and password.
4. The HP device sends a request containing the username and password to the TACACS server.
5. The username and password are validated in the TACACS server's database.
6. If the password is valid, the user is authenticated.
TACACS+ Authentication
When TACACS+ authentication takes place, the following events occur:
1. A user attempts to gain access to the HP device by doing one of the following:
• Logging into the device using Telnet, SSH, or the Web management interface
• Entering the Privileged EXEC level or CONFIG level of the CLI
2. The user is prompted for a username.
3. The user enters a username.
4. The HP device obtains a password prompt from a TACACS+ server.
5. The user is prompted for a password.
6. The user enters a password.
7. The HP device sends the password to the TACACS+ server.
8. The password is validated in the TACACS+ server's database.
9. If the password is valid, the user is authenticated.
June 2005
Securing Access to Management Functions
2 - 21