Limit Console Access For Aaa-Based Users - Cisco ASR 5000 Series Administration Manual

Limit Console Access for AAA-based Users

Important
Limit Console Access for AAA-based Users
AAA-based users normally login through on a vty line. However, you may want to limit a few users to
accessing just the Console line. If you do not use the local-user database (or you are running a Trusted build),
this needs to be done by limiting access to the Console line for other AAA-based users. Enable the noconsole
keyword for all levels of admin users that will not have access to the Console line.
The noconsole keyword is available for the Context Configuration mode commands shown below.
configure
context <ctx_name>
The noconsole keyword disables user access to the Console line. By default noconsole is not enabled, thus
all AAA-based users can access the Console line.
Important
Verify Configuration Changes
You can verify changes made related to the separation of authentication methods via the Exec mode show
configuration command. After saving the configuration changes, run show configuration |grep noconsole
and show configuration |grep novty. The output of these commands will indicate any changes you have
made.
Configuring a Chassis Key
A chassis key should be configured for each system. This key is used to decrypt encrypted passwords found
in configuration files.
Overview
The chassis key is used to encrypt and decrypt encrypted passwords in the configuration file. If two or more
chassis are configured with the same chassis key value, the encrypted passwords can be decrypted by any of
the chassis sharing the same chassis key value. As a corollary to this, a given chassis key value will not be
able to decrypt passwords that were encrypted with a different chassis key value.
ASR 5500 System Administration Guide, StarOS Release 21.4
66
This command does not apply for a Trusted build because the local-used database is unavailable.
administrator <username> { encrypted | nopassword | password } noconsole
config-administrator <username> { encrypted | nopassword | password } noconsole
inspector <username> { encrypted | nopassword | password } noconsole
operator <username> { encrypted | nopassword | password } noconsole
exit
The local-user allow-aaa-authentication noconsole command takes precedence. In that case, all
AAA-based users cannot access the Console line.
System Settings