Table of Contents
Advertisement
Entering CLI Modes
Authentication
local and then TACAS
TACAS and then local
When local authentication is in effect and a user logs in, the user must be configured as a CLI user. The
login username and password are verified against the local CLI user database. If a match is found, the
login succeeds, and the user is assigned a pre-configured privilege level.
When TACACS+ authentication is in effect, the login username and password are passed to the
TACACS+ server for verification. The TACACS+ server verifies the login username and password, and
it sends back a reply. No TACACS+ user information is stored locally. The show user all command
shows local users only.
The config TACACS-server host command (see
IP address of TACACS+ servers. There can be three TACACS+ servers configured. The first server is
queried, the second server is queried if the first server is not reachable, and the third server is queried if
the both of the other servers are not reachable.
Cisco supports only TACACS+ authentication; therefore, no privilege level is verified against the
TACACS+ server. All users authenticated by the TACACS+ server are given unrestricted rights. If a
TACACS+ user makes changes to system configuration, the log will include the TACACS+ username
and the config information, just as it does for a local user.
Like RADIUS users, the TACACS+ users do not have associating SNMP community strings. There are
no SNMP logins for TACACS+ users.
The following are limitations to TACACS+ authentication:
Note
TACACS+ authorization and accounting are not supported.
TACACS+ single-connection not supported. Each login authentication makes its own connection to the
TACACS+ server.
TACACS+ user privilege level is always unrestricted.
Customizing the Login Prompt
The CLI checks the file login-banner for customized text to include in the prompt. Use the copy
command to place a file named login-banner in the config directory of the switch. You can do this with
FTP:
copy ftp://user:xxx.x.x.x/my-banner config:login-banner
Entering CLI Modes
The CLI uses the following three command modes:
•
•
•
Cisco SFS 7000 Series Product Family Command Reference Guide
1-4
User Execute mode
Privileged Execute mode
Global Configuration mode
How it Works
Verifies against the chassis database then checks the TACAS client.
Checks the TACAS client and then verifies against the chassis
database.
config TACACS-server host, page
Chapter 1
Using the CLI
2-22) configures the
OL-9163-02
Advertisement
Table of Contents
