H3C S7500 Series Operation Manual page 542

Operation Manual – AAA & RADIUS & HWTACACS & EAD
H3C S7500 Series Ethernet Switches
Authorize the user to
access the specified
type(s) of service(s)
Set the priority level of the
user
Set the attributes of the
user whose service type is
lan-access
Caution:
The character string of user-name cannot contain "/", ":", "*", "?", "<" or ">". Moreover,
"@" can be used no more than once.
After the local-user password-display-mode cipher-force command is executed,
all the passwords will be displayed in cipher mode even if you have specified to
display user passwords in plain text by using the password command.
If the configured authentication method (local or RADIUS) requires a user name and
a password, the command level that a user can access after login is determined by
the priority level of the user. For SSH users, when they use RSA shared keys for
authentication, the commands they can access are determined by the levels set on
their user interfaces.
If the configured authentication method is none or requires a password, the
command level that a user can access after login is determined by the level of the
user interface.
To do...
service-type { ftp |
lan-access | { telnet |
ssh | terminal }* [ level
level ] }
level level
attribute { ip ip-address |
mac mac-address |
idle-cut second |
access-limit
max-user-number | vlan
vlan-id | location { nas-ip
ip-address port
port-number | port
port-number } }*
Chapter 1 AAA & RADIUS & HWTACACS
Use the command...
1-20
Configuration
Remarks
Required
By default, the system
does not authorize the
user to access any
service.
Optional
By default, the priority
level of the user is 0.
Optional
If the user is bound to a
remote port, you need to
specify the nas-ip
parameter (the following
ip-address is 127.0.0.1 by
default, representing this
device). If the user is
bound to a local port, the
nas-ip keyword is not
required.