H3C S5830V2 Security Configuration Manual page 34

Step
3. (Optional.) Configure a
password for the local
user.
4. Assign services for the
local user.
5. (Optional.) Place the local
user to the active or
blocked state.
6. (Optional.) Configure
binding attributes for the
local user.
7. (Optional.) Configure
authorization attributes for
the local user.
Command
•
For a network access user:
password { cipher | simple }
password
•
For a device management user
in non-FIPS mode:
password [ { hash | simple }
password ]
•
For a device management user
in FIPS mode:
password
•
In non-FIPS mode:
service-type { ftp | lan-access |
{ ssh | telnet | terminal } * }
•
In FIPS mode:
service-type { lan-access | { ssh
| terminal } * }
state { active | block }
bind-attribute { ip ip-address |
location port slot-number
subslot-number port-number | mac
mac-address | vlan vlan-id } *
authorization-attribute { acl
acl-number | idle-cut minute |
user-role role-name | vlan vlan-id |
work-directory directory-name } *
20
Remarks
Network access user passwords are
encrypted with the encryption
algorithm and saved in ciphertext.
Device management user passwords
are encrypted with the hash
algorithm and saved in ciphertext.
A local user with no password
configured directly passes
authentication after providing the
valid local username and attributes.
To enhance security, configure a
password for each local user.
By default, no service is authorized to
a local user.
By default, a created local user is in
active state and can request network
services.
By default, no binding attribute is
configured for a local user.
Binding attribute ip applies only to
LAN users using 802.1X.
Binding attributes location, mac, and
vlan apply only to LAN users.
The following default settings apply:
•
No authorization ACL, idle
timeout period, or authorized
VLAN is configured for local
users.
•
FTP, SFTP, or SCP users are
authorized access to the root
directory of the device, but they
do not have the access
permission.
•
The network-operator user role is
assigned to local users that are
created by a network-admin or
level- 1 5 user.
For LAN users, only the settings for
acl, idle-cut, and vlan take effect.
For Telnet and terminal users, only
the setting for user-role takes effect.
For SSH and FTP users, only the
settings for user-role and
work-directory take effect.
For other types of local users, no
authorization attribute takes effect.