Login Authentication Modes; User Roles - HP 10500 Series Configuration Manual

An absolute number uniquely identifies a user line among all user lines. The user lines are numbered
starting from 0 and incrementing by 1 and in the sequence of AUX and VTY lines. You can use the
display line command without any parameters to view supported user lines and their absolute numbers.
A relative number uniquely identifies a user line among all user lines that are the same type. The number
format is user line type + number. User lines are numbered starting from 0 and incrementing by 1. For
example, the first VTY line is VTY 0.

Login authentication modes

You can configure login authentication to prevent illegal access to the device CLI.
In non-FIPS mode, the device supports the following login authentication modes:
None—Disables authentication. This mode allows access without authentication and is insecure.
•
Password—Requires password authentication.
•
Scheme—Uses the AAA module to provide local or remote login authentication. You must provide
•
a username and password at login.
In FIPS mode, the device supports only the scheme authentication mode.
Different login authentication modes require different user line configurations, as shown in
Table 10 Configuration required for different login authentication modes
Authentication mode
None
Password
Scheme

User roles

A user is assigned user roles at login. The user roles dictate the commands that the user can execute. For
more information about user roles, see "Configuring RBAC."
The device assigns user roles based on the login authentication mode, user type, and login method.
In none or password authentication mode, the device assigns the user roles specified for the user
•
line.
In scheme authentication mode, the device uses the following rules to assign user roles:
•
For an SSH login user who uses publickey or password-publickey authentication, the device
assigns the user roles specified for the local device management user with the same name.
For other users, the device assigns user roles according to the user role configuration of the AAA
module. If the AAA server does not assign any user roles and the default user role feature is
disabled, a remote AAA authentication user cannot log in.
Configuration tasks
Set the authentication mode to none.
5. Set the authentication mode to password.
6. Set a password.
7. Set the authentication mode to scheme.
8. Configure login authentication methods in ISP domain view. For more
information, see Security Configuration Guide.
48
Table 10.