Extreme Networks 200 Series Installation And User Manual page 70

Managing the Switch
Within the configuration file, additional keywords are available for
users
Extreme-CLI-Authorization
function and indicate a profile name for that user. If authorization is enabled without specifying a valid
profile, the user is unable to perform any commands.
Next, define the desired profiles in an ASCII configuration file called
named profiles of exact or partial strings of CLI commands. A named profile is linked with a user
through the file. A profile with the
users
A profile with the keyword allows use of all commands except the listed commands.
deny
CLI commands can be defined easily in a hierarchal manner by using an asterisk (*) to indicate any
possible subsequent entry. The parser performs exact string matches on other text to validate
commands. Commands are separated by a comma (,) or newline.
Looking at the following example content in profiles for the profile named
keyword, the following attributes are associated with the user of this profile:
deny
• Cannot use any command starting with
• Cannot issue the
disable ipforwarding
• Cannot issue a
show switch
• Can perform all other commands.
We know from the
users
able to log in, but is unable to perform any commands, because he has no valid profile assigned.
In , a user associated with this profile can use any
PROFILE2
command and the
show management
also know from the
users
The following lists the contents of the file
user Password = ""
Filter-Id = "unlim"
admin Password = "", Service-Type = Administrative
Filter-Id = "unlim"
eric Password = "", Service-Type = Administrative, Profile-Name = ""
Filter-Id = "unlim"
Extreme:Extreme-CLI-Authorization = Enabled
albert Password = "", Service-Type = Administrative, Profile-Name =
"Profile1"
Filter-Id = "unlim"
Extreme:Extreme-CLI-Authorization = Enabled
lulu Password = "", Service-Type = Administrative, Profile-Name =
"Profile1"
Filter-Id = "unlim"
Extreme:Extreme-CLI-Authorization = Enabled
gerald Password = "", Service-Type = Administrative, Profile-Name "Profile2"
Filter-Id = "unlim"
Extreme:Extreme-CLI-Authorization = Enabled
68
. To use per-command authentication, enable the CLI authorization
permit on
enable
command.
command.
file that this applies to the users
command, but can perform no other functions on the switch. We
file that has these capabilities.
gerald
with support for per-command authentication:
users
Profile-Name
profiles
keywords allows use of only the listed commands.
.
and
albert lulu
command, the
enable
and
. This file contains
, which uses the
PROFILE1
. We also know that
eric
clear counter
Summit 200 Series Switch Installation and User Guide
is