HP ProCurve 9304M Security Manual page 38

Security Guide for ProCurve 9300/9400 Series Routing Switches
TACACS+ Authorization
HP devices support two kinds of TACACS+ authorization:
• Exec authorization determines a user's privilege level when they are authenticated
• Command authorization consults a TACACS+ server to get authorization for commands entered by the user
When TACACS+ exec authorization takes place, the following events occur:
1. A user logs into the HP device using Telnet, SSH, or the Web management interface
2. The user is authenticated.
3. The HP device consults the TACACS+ server to determine the privilege level of the user.
4. The TACACS+ server sends back a response containing an A-V (Attribute-Value) pair with the privilege level
of the user.
5. The user is granted the specified privilege level.
When TACACS+ command authorization takes place, the following events occur:
1. A Telnet, SSH, or Web management interface user previously authenticated by a TACACS+ server enters a
command on the HP device.
2. The HP device looks at its configuration to see if the command is at a privilege level that requires TACACS+
command authorization.
3. If the command belongs to a privilege level that requires authorization, the HP device consults the TACACS+
server to see if the user is authorized to use the command.
4. If the user is authorized to use the command, the command is executed.
TACACS+ Accounting
TACACS+ accounting works as follows:
1. One of the following events occur on the HP device:
• A user logs into the management interface using Telnet or SSH
• A user enters a command for which accounting has been configured
• A system event occurs, such as a reboot or reloading of the configuration file
2. The HP device checks its configuration to see if the event is one for which TACACS+ accounting is required.
3. If the event requires TACACS+ accounting, the HP device sends a TACACS+ Accounting Start packet to the
TACACS+ accounting server, containing information about the event.
4. The TACACS+ accounting server acknowledges the Accounting Start packet.
5. The TACACS+ accounting server records information about the event.
6. When the event is concluded, the HP device sends an Accounting Stop packet to the TACACS+ accounting
server.
7. The TACACS+ accounting server acknowledges the Accounting Stop packet.
2 - 22 June 2005