Creating an Allowed Users List
The
allowusers add
command allows an administrator to create a list of users who may log into the StarOS
CLI.
Step 1
Enter the context configuration mode.
[local]
host_name
(config)#
context context_name
[local]
host_name
(config-ctx)#
Step 2
Go to the SSH Configuration mode.
[local]
host_name
(config-ctx)#
server sshd
Step 3
Configure the SSH user list.
[local]
host_name
(config-sshd)#
allowusers add user_list
user_list
specifies a list of user name patterns, separated by spaces, as an alphanumeric string of 1 through 999 characters.
If the pattern takes the form 'USER' then login is restricted for that user.
If the pattern is in the format 'USER@IP_ADDRESS' then user name and IP address are separately checked, restricting
logins to those users from that particular IP address.
If the pattern is in the format 'USER@<context>@IP_ADDRESS' then user name, StarOS context and IP address are
separately checked, restricting logins to those users associated with the specific context from that particular IP address.
The following limits apply to the
user_list
:
•
The maximum length of this string is 3000 bytes including spaces.
•
The maximum number of AllowUsers, which is counted by spaces, is 256, which is consistent with the limit from
OpenSSH.
If you exceed either of the above limits, an error message is displayed. The message prompts you to use a
regular expression pattern to shorten the string, or remove all the allowusers with
no allowusers add
or
default allowusers add
and re-configure.
Important
For additional information, see the
SSH Configuration Mode Commands
chapter in the
Command Line Interface Reference
.
Step 4
Exit the SSH Configuration mode.
[local]
host_name
(config-sshd)#
end
[local]
host_name
#
SSH User Login Authentication
StarOS authenticates SSH user login attempts via authorized-key/user-account pairings for the following
scenarios:
•
User tries to login with local context username through local context (VPN) interface with authorized-key
configured on local context.
•
User tries to login with non-local context username through non-local context interface with
authorized-key configured on non-local context.
ASR 5500 System Administration Guide, StarOS Release 21.5
19
Getting Started
SSH User Login Authentication
