Administrator Guide

272 Authentication, Authorization, and Accounting
Access Lines
There are five access lines: console, Telnet, SSH, HTTP, and HTTPS. HTTP
and HTTPS are not configured using AAA method lists. Instead, the
authentication list for HTTP and HTTPS is configured directly
(authorization and accounting are not supported). The default method lists
for both the HTTP and HTTPS access lines consist of only the local method.
Each of the other access lines may be assigned method lists independently for
the AAA services.
The SSH line has built-in authentication beyond that configured by the
administrator.
In the SSH protocol itself, there are multiple methods for authentication.
These are not the authentication methods configured in AAA, but are
internal to SSH itself. When an SSH connection is attempted, the challenge-
response method is specified in the connection request.
The methods available for authentication are: host-based authentication,
public key authentication, challenge-response authentication, and password
authentication. Authentication methods are tried in the order specified
above, although SSH-2 has a configuration option to change the default
order.
Host-based authentication operates as follows:
If the host from which the user logs in is listed in a specific file
(/etc/hosts.equiv or /etc/ssh/shosts.equiv) on the remote host, and the user
names are the same on both hosts, or if the files ~/.rhosts or ~/.shosts exist in
the user's home directory on the remote host and contain a line containing
the name of the client machine and the name of the user on that machine,
the user is considered for login. Additionally, the server must be able to verify
the client's host key for login to be permitted. This authentication method
closes security holes due to IP spoofing, DNS spoofing, and routing spoofing.
Authorization (commands) dfltCmdAuthList none
Accounting (exec) dfltExecList tacacs (start-stop)
Accounting (commands) dfltCmdList tacacs (stop-only)
Table 10-2. Default Method Lists (Continued)
AAA Service (type) List Name List Methods