Commands Authorization Type; Enabling Authorization With The Cli - ProCurve 2610 Manual

RADIUS Authentication and Accounting
Configuring RADIUS Authorization
Note
5-20

Commands Authorization Type

The authorization type implemented on the switches covered in this guide is
the "commands" method. This method explicitly specifies on the RADIUS
server which commands are allowed on the client device for authenticated
users. This is done on a per-user or per-group basis.
The commands authorization will only be executed for commands entered
from Telnet, SSH, or console sessions. The Web management interface is not
supported.
By default, all users may execute a minimal set of commands regardless of
their authorization status, for example, "exit" and "logout". This minimal set
of commands can prevent deadlock on the switch due to an error in the user's
authorization profile on the RADIUS server.

Enabling Authorization with the CLI

To configure authorization for controlling access to the CLI commands, enter
this command.
Syntax: [no] aaa authorization <commands> <radius | none>
Configures authorization for controlling access to CLI
commands. When enabled, the switch checks the list of commands
supplied by the RADIUS server during user authentication to
determine if a command entered by the user can be executed.
radius: The NAS requests authorization information from the
RADIUS server. Authorization rights are assigned by user or
group.
none
: The NAS does not request authorization information.
For example, to enable the RADIUS protocol as the authorization method:
ProCurve(config)# aaa authorization commands radius
When the NAS sends the RADIUS server a valid username and password, the
RADIUS server sends an Access-Accept packet that contains two attributes
—the command list and the command exception flag. When an authenticated
user enters a command on the switch, the switch examines the list of com­
mands delivered in the RADIUS Access-Accept packet as well as the command
exception flag, which indicates whether the user has permission to execute
the commands in the list. See Configuring the RADIUS Server on page 5-20.