HP 5830 Series Configuration Manual page 24

in again, but the commands they can execute have changed. For example, with the user privilege level
3, a user can configure system parameters. After switching to user privilege level 0, the user can execute
only basic commands like ping and tracert and use a few display commands. The switching operation
is effective for the current login. After the user logs in again, the user privilege restores to the original
level.
To avoid problems, HP recommends that administrators log in with a lower privilege level to view switch
operating parameters, and switch to a higher level temporarily only when they must maintain the device.
When administrators must leave for a while or ask someone else to manage the device temporarily, they
can switch to a lower privilege level before they leave to restrict the operation by others.
Configuring the authentication parameters for user privilege level switching
A user can switch to a lower privilege level without authentication. To switch to a higher privilege level,
however, a user must provide the privilege level switching authentication information (if any).
shows the privilege level switching authentication modes the device supports.
Table 8 Privilege level switching authentication modes
Authentication
mode
Local password
authentication
only (local-only)
Remote AAA
authentication
through
HWTACACS or
RADIUS
Local password
authentication first
and then remote
AAA
authentication
Remote AAA
authentication first
and then local
password
authentication
To configure the authentication parameters for a user privilege level:
Step
1. Enter system view.
Keywords Description
The device uses the locally configured passwords for privilege level
switching authentication.
local
To use this mode, you must set the password for privilege level
switching using the super password command.
The device sends the username and password for privilege level
switching to the HWTACACS or RADIUS server for remote
authentication.
To use this mode, you must perform the following configuration
tasks:
scheme
•
•
The device first uses the locally configured passwords for privilege
level switching authentication. If no local password is set, the device
local scheme
allows AUX users to switch their privilege levels without
authentication, but performs AAA authentication for VTY users.
AAA authentication is performed first, and if the remote
HWTACACS or RADIUS server does not respond or AAA
scheme local
configuration on the device is invalid, the local password
authentication is performed.
Command
system-view
Configure the required HWTACACS or RADIUS schemes and
configure the ISP domain to use the schemes for users. For more
information, see Security Configuration Guide.
Add user accounts and specify the user passwords on the
HWTACACS or RADIUS server.
17
Remarks
N/A
Table 8