Authentication And Authorization For Ssh Users By A Radius Server; Network Requirements - HP 5920 Series Configuration Manual

[Switch] hwtacacs scheme hwtac
[Switch-hwtacacs-hwtac] primary authorization 10.1.1.2 49
[Switch-hwtacacs-hwtac] key authorization simple expert
[Switch-hwtacacs-hwtac] user-name-format without-domain
[Switch-hwtacacs-hwtac] quit
# Configure a RADIUS scheme.
[Switch] radius scheme rd
[Switch-radius-rd] primary accounting 10.1.1.1 1813
[Switch-radius-rd] key accounting simple expert
[Switch-radius-rd] user-name-format without-domain
[Switch-radius-rd] quit
# Create a device management user.
[Switch] local-user hello class manage
# Assign the SSH service for the local user.
[Switch-luser-manage-hello] service-type ssh
# Set a password for the local user to hello in plain text.
[Switch-luser-manage-hello] password simple hello
[Switch-luser-manage-hello] quit
# Create ISP domain bbb and configure AAA methods for login users.
[Switch] domain bbb
[Switch-isp-bbb] authentication login local
[Switch-isp-bbb] authorization login hwtacacs-scheme hwtac
[Switch-isp-bbb] accounting login radius-scheme rd
[Switch-isp-bbb] quit
# Enable the default-user-role authorization function, so that an SSH user gets the default user role
network-operator after passing authentication.
[Switch] role default-role enable
Verify the configuration:
4.
When the user initiates an SSH connection to the switch and enter the username hello@bbb and
the correct password, the user successfully logs in and can use the commands for the
network-operator user role.
Authentication and authorization for SSH users by a
RADIUS server

Network requirements

As shown in
Configure the switch to use the RADIUS server for SSH user authentication and authorization and add an
account with the username hello@bbb on the RADIUS server, so that the SSH user can log in to the switch
and is authorized with the network-operator user role after login.
Set the shared keys for secure RADIUS communication to expert, and set the ports for authentication and
accounting to 1812 and 1813, respectively. Configure the switch to include the domain name in the
username sent to the RADIUS server.
Figure 13, the RADIUS authentication and authorization server runs on IMC.
46