R211x-HP Flexfabric 11900 Security Command Reference

24
Usage guidelines
Every configurable authorization attribute has its definite application environments and purposes.
Consider the service types of users when assigning authorization attributes:
• For LAN users, only the authorization attributes acl, idle-cut, and vlan are effective.
• For Telnet and terminal users, only the authorization attribute user-role is effective.
• For SSH and FTP users, only the authorization attributes user-role and work-directory are effective.
• For other types of local users, no authorization attribute is effective.
Authorization attributes configured for a user group are intended for all local users in the group. You can
group local users to improve configuration and management efficiency. An authorization attribute
configured in local user view takes precedence over the same attribute configured in user group view.
To make sure that FTP, SFTP, and SCP users can access the directory after a switchover between the active
MPU and the standby MPU, do not specify slot information for the work directory.
To make the user have only the user role authorized by this command, use the undo
authorization-attribute user-role command to remove the predefined user roles.
The security-audit user role has access to the commands for managing security log files and security log
file system. To display all the accessible commands of the security-audit user role, use the display role
name security-audit command. For more information about security log management, see Network
Management and Monitoring Configuration Guide. For more information about file system
management, see Fundamentals Configuration Guide.
When you configure the security-audit user role, follow these restrictions and guidelines:
• If a local user is the only one with the security-audit user role, this local user cannot be deleted.
• The user role security-audit is mutually exclusive with other user roles.
{ When you assign the security-audit user role to a local user, the system requests confirmation to
delete all the other user roles of the user.
{ When you assign other user roles to a local user who has the security-audit user role, the system
requests confirmation to delete the security-audit user role for the local user.
Examples
# Configure the authorized VLAN of the network access user abc as VLAN 2.
<Sysname> system-view
[Sysname] local-user abc class network
[Sysname-luser-network-abc] authorization-attribute vlan 2
# Configure the authorized VLAN of user group abc as VLAN 3.
<Sysname> system-view
[Sysname] user-group abc
[Sysname-ugroup-abc] authorization-attribute vlan 3
Related commands
• display local-user
• display user-group
bind-attribute
Use bind-attribute to configure binding attributes for a local user.