Configuring a user privilege level – H3C Technologies H3C S12500 Series Switches User Manual
Page 26
14
Configuring a user privilege level
If the authentication mode on a user interface is scheme, configure a user privilege level for users that
access the interface by using the AAA module or directly on the user interface. For SSH users that use
public-key authentication, the user privilege level configured directly on the user interface always takes
effect. For other users, the user privilege level configured in the AAA module has priority over the one
configured directly on the user interface.
If the authentication mode on a user interface is none or password, configure the user privilege level
directly on the user interface.
For more information about user login authentication, see "Logging in to the CLI." For more information
about AAA and SSH, see Security Configuration Guide.
Configuring a user privilege level for users by using the AAA module
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter user interface view.
user-interface { first-num1
[ last-num1 ] | { aux | console |
vty } first-num2 [ last-num2 ] }
N/A
3.
Specify the scheme
authentication mode.
authentication-mode scheme
By default, the authentication
mode for VTY and AUX users is
password, and no authentication is
needed for console users.
4.
Return to system view.
quit
N/A
5.
Configure the authentication
mode for SSH users as
password.
For more information, see Security
Configuration Guide.
This task is required only for SSH
users that are required to provide
their usernames and passwords for
authentication.
6.
Configure the user privilege
level by using the AAA
module.
•
To use local authentication:
a.
Use the local-user
command to create a
local user and enter local
user view.
b.
Use the level keyword in
the
authorization-attribute
command to configure the
user privilege level.
•
To use remote authentication
(RADIUS, HWTACACS, or
LDAP):
Configure the user privilege
level on the authentication
server
User either method.
For local authentication, if you do
not configure the user privilege
level, the user privilege level is 0.
For remote authentication, if you
do not configure the user privilege
level, the user privilege level
depends on the default
configuration of the authentication
server.
For more information about the
local-user and
authorization-attribute commands,
see Security Command Reference.
For example:
# Configure the switch to use local authentication for Telnet users on VTY 1, and set the user privilege
level to 3.
<Sysname> system-view