Configuring local users

To implement local AAA, you must create local users and configure user attributes on the device. Local users and attributes are stored on the device in the local user database. Local users are uniquely identified by username. Configurable local user attributes are as follows:

Local user configuration task list

Configuring local user attributes

Follow these guidelines when you configure local user attributes:

To configure the attributes of a local user:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Add a local user and enter local user view.

local-user user-name

By default, a local user exists.

3. Configure a password for the local user.

  • In non-FIPS mode:password [ [ hash ] { cipher | simple } password ]

  • In FIPS mode:password

Optional.

In non-FIPS mode, a non-password-protected user passes authentication if the user provides the correct username and passes attribute checks. To enhance security, configure a password for each local user.

In FIPS mode, only password-protected users can pass authentication.

4. Assign service types for the local user.

  • In non-FIPS mode:service-type { ftp | lan-access | { ssh | telnet | terminal } * | portal | web }

  • In FIPS mode:service-type { lan-access | { ssh | terminal } * | portal | web }

By default, no service is authorized to a local user.

5. Place the local user to the active or blocked state.

state { active | block }

Optional.

By default, a created local user is in active state and can request network services.

6. Set the maximum number of concurrent users of the local user account.

access-limit max-user-number

Optional.

By default, there is no limit to the maximum number of concurrent users of a local user account.

The limit is effective only for local accounting and is not effective for FTP users.

7. Configure password control attributes for the local user.

  • Set the password aging time:password-control aging aging-time

  • Set the minimum password length:password-control length length

  • Configure the password composition policy:password-control composition type-number type-number [ type-length type-length ]

Optional.

By default, the password control attributes of the user group apply. If the user group has no password control attributes configured, the global settings apply. The global settings include a 90-day password aging time, a minimum 10-character password length, one type number, and one type length.

8. Configure binding attributes for the local user.

bind-attribute { ip ip-address | location port slot-number subslot-number port-number | mac mac-address | vlan vlan-id } *

Optional.

By default, no binding attribute is configured for a local user.

9. Configure authorization attributes for the local user.

authorization-attribute { acl acl-number | idle-cut minute | level level | user-profile profile-name | user-role { guest | guest-manager | security-audit } | vlan vlan-id | work-directory directory-name } *

Optional.

By default, no authorization attribute is configured for a local user.

For LAN users, only acl, idle-cut, user-profile, and vlan are supported.

For portal users, only acl, user-profile, and vlan are supported.

For SSH, Web, and terminal users, only level is supported.

For FTP users, only level and work-directory are supported.

For Telnet users, only level and user-role are supported.

For other types of users, no authorization attributes are supported.

10. Set the validity time of the local user.

validity-date time

Optional.

Not set by default.

11. Set the expiration time of the local user.

expiration-date time

Optional.

Not set by default.

12. Assign the local user to a user group.

group group-name

Optional.

By default, a local user belongs to the default user group system.

Configuring user group attributes

User groups simplify local user configuration and management. A user group comprises a group of local users and has a set of local user attributes. Configure local user attributes for a user group to implement centralized user attributes management for the local users in the group. Configurable user attributes include password control attributes and authorization attributes.

By default, every newly added local user belongs to the default user group system and bears all attributes of the group. To assign a local user to a different user group, use the user-group command in local user view.

To configure attributes for a user group:

Step

Command

Remarks

1. Enter system view.

system-view

N/A

2. Create a user group and enter user group view.

user-group group-name

N/A

3. Configure password control attributes for the user group.

  • Set the password aging time:password-control aging aging-time

  • Set the minimum password length:password-control length length

  • Configure the password composition policy:password-control composition type-number type-number [ type-length type-length ]

Optional.

By default, the global settings apply. The global settings include a 90-day password aging time, a minimum 10-character password length, one type number, and one type length.

4. Configure authorization attributes for the user group.

authorization-attribute { acl acl-number | idle-cut minute | level level | user-profile profile-name | vlan vlan-id | work-directory directory-name } *

Optional.

By default, no authorization attribute is configured for a user group.

For LAN users, only acl, idle-cut, user-profile, and vlan are supported.

For portal users, only acl, user-profile, and vlan are supported.

For SSH, Web, and terminal users, only level is supported.

For FTP users, only level and work-directory are supported.

For Telnet users, only level is supported.

For other types of users, no authorization attributes are supported.

5. Set the guest attribute for the user group.

group-attribute allow-guest

Optional.

By default, the guest attribute is not set for a user group, and guest users created by a guest manager through the Web interface cannot join the group.

Displaying and maintaining local users and local user groups

Task

Command

Remarks

Display local user information.

display local-user [ idle-cut { disable | enable } | service-type { ftp | lan-access | portal | ssh | telnet | terminal | web } | state { active | block } | user-name user-name | vlan vlan-id ] [ slot slot-number ] [ | { begin | exclude | include } regular-expression ]

Available in any view.

Display user group configuration information.

display user-group [ group-name ] [ | { begin | exclude | include } regular-expression ]

Available in any view.