Local authentication, HWTACACS authorization, and RADIUS accounting for SSH users

As shown in Figure 11, configure the switch to meet the following requirements:

• Perform local authentication for SSH servers.

• Use the HWTACACS server and RADIUS server for SSH user authorization and accounting, respectively.

• Exclude domain names from the usernames sent to the servers.

• Assign the default user role network-operator to SSH users after they pass authentication.

Configure an account with the username hello for the SSH user. Configure the shared keys for secure communication with the HWTACACS server and RADIUS server to expert.

1. Configure the HWTACACS server. (Details not shown.)

2. Configure the RADIUS server. (Details not shown.)

3. Configure the switch:

   # Configure IP addresses for interfaces. (Details not shown.)

   # Create local RSA and DSA key pairs.

   <Switch> system-view
   [Switch] public-key local create rsa
   [Switch] public-key local create dsa
   

   # Enable the SSH service.

   [Switch] ssh server enable
   

   # Enable scheme authentication for user lines VTY 0 through VTY 63.

   [Switch] line vty 0 63
   [Switch-line-vty0-63] authentication-mode scheme
   [Switch-line-vty0-63] quit
   

   # Configure an HWTACACS scheme.

   [Switch] hwtacacs scheme hwtac
   [Switch-hwtacacs-hwtac] primary authorization 10.1.1.2 49
   [Switch-hwtacacs-hwtac] key authorization simple expert
   [Switch-hwtacacs-hwtac] user-name-format without-domain
   [Switch-hwtacacs-hwtac] quit
   

   # Configure a RADIUS scheme.

   [Switch] radius scheme rd
   [Switch-radius-rd] primary accounting 10.1.1.1 1813
   [Switch-radius-rd] key accounting simple expert
   [Switch-radius-rd] user-name-format without-domain
   [Switch-radius-rd] quit
   

   # Create a device management user.

   [Switch] local-user hello class manage
   

   # Assign the SSH service for the local user.

   [Switch-luser-manage-hello] service-type ssh
   

   # Set a password for the local user to 123456TESTplat&! in plain text. In FIPS mode, you must set the password in interactive mode.

   [Switch-luser-manage-hello] password simple 123456TESTplat&!
   [Switch-luser-manage-hello] quit
   

   # Create ISP domain bbb and configure the login users to use local authentication, HWTACACS authorization, and RADIUS accounting.

   [Switch] domain bbb
   [Switch-isp-bbb] authentication login local
   [Switch-isp-bbb] authorization login hwtacacs-scheme hwtac
   [Switch-isp-bbb] accounting login radius-scheme rd
   [Switch-isp-bbb] quit
   

   # Enable the default user role feature to assign authenticated SSH users the default user role network-operator.

   [Switch] role default-role enable
   

# Initiate an SSH connection to the switch, and enter the username hello@bbb and the correct password. The user logs in to the switch. (Details not shown.)

# Verify that the user can use the commands permitted by the network-operator user role. (Details not shown.)