Extreme Networks Summit 300-48 Software User's Manual page 47

#homeless
#xyz.merit.edu
#anyoldthing:1234
10.202.1.3
10.203.1.41
10.203.1.42
10.0.52.14
users
user Password = ""
Filter-Id = "unlim"
admin Password = "", Service-Type = Administrative
Filter-Id = "unlim"
eric Password = "", Service-Type = Administrative
Filter-Id = "unlim"
albert
Filter-Id = "unlim"
samuel Password = "password", Service-Type = Administrative
Filter-Id = "unlim"
RADIUS Per-Command Configuration Example
Building on this example configuration, you can use RADIUS to perform per-command authentication
to differentiate user capabilities. To do so, use the Extreme-modified RADIUS Merit software that is
available from the Extreme Networks web server at
http://www.extremenetworks.com/extreme/support/otherapps.htm or by contacting Extreme
Networks technical support. The software is available in compiled format for Solaris
operating systems, as well as in source code format. For all clients that use RADIUS per-command
authentication, you must add the following type to the client file:
type:extreme:nas + RAD_RFC + ACCT_RFC
Within the
users
Extreme-CLI-Authorization
function and indicate a profile name for that user. If authorization is enabled without specifying a valid
profile, the user is unable to perform any commands.
Next, define the desired profiles in an ASCII configuration file called
named profiles of exact or partial strings of CLI commands. A named profile is linked with a user
through the
A profile with the
CLI commands can be defined easily in a hierarchal manner by using an asterisk (*) to indicate any
possible subsequent entry. The parser performs exact string matches on other text to validate
commands. Commands are separated by a comma (,) or newline.
Looking at the following example content in profiles for the profile named
keyword, the following attributes are associated with the user of this profile:
deny
• Cannot use any command starting with
• Cannot issue the
Summit 300-48 Switch Software User Guide
testing
moretesting
whoknows?
andrew-linux
eric
eric
samf
Password = "password", Service-Type = Administrative
configuration file, additional keywords are available for
. To use per-command authentication, enable the CLI authorization
file. A profile with the
users
keyword allows use of all commands except the listed commands.
deny
disable ipforwarding
type proxy v1
type=Ascend:NAS v1
type=NAS+RAD_RFC+ACCT_RFC
type=nas
type=nas
type=nas
type=nas
keywords allows use of only the listed commands.
permit on
.
enable
command.
Authenticating Users
™ or Linux
and
Profile-Name
. This file contains
profiles
, which uses the
PROFILE1
™
47