19
To do…
Command…
Remarks
10.
Configure the authorization
attributes for the local user.
authorization-attribute
{
acl
acl-number
|
callback-number
callback-number
|
idle-
cut
minute
|
level
level
|
user-profile
profile-
name
|
user-role
security-audit
|
vlan
vlan-id
|
work-
directory
directory-
name
} *
Optional.
By default, no authorization attribute is
configured for a local user.
Attributes supported:
•
PPP users—
acl
,
callback-number
,
idle-
cut
, and
user-profile
.
•
LAN and portal users—
acl
,
idle-cut
,
user-
profile
, and
vlan
.
•
SSH, terminal, and web users—
level
.
•
FTP users—
level
and
work-directory
.
•
Telnet users—
level
and
user-role
.
•
Other types of local users—No binding
attributes are supported.
•
Web users—Binding attributes are only
supported on centralized routers.
11.
Set the expiration time of the
local user.
expiration-date
time
Optional.
Not set by default.
12.
Assign the local user to a user
group.
group
group-name
Optional
By default, a local user belongs to the default
user group
system
.
NOTE:
•
For more information about password control attributes configuration commands, see
Security
Command Reference.
•
On a router supporting the password control feature, local user passwords are not displayed, and
local-user password-display-mode
is not effective.
•
If you configure
local-user password-display-mode
cipher-force
, all existing local user passwords
are displayed in cipher text, regardless of the configuration of
password
. If you also save the
configuration and restart the router, all existing local user passwords are always displayed in cipher
text, no matter how you configure
local-user password-display-mode
or
password
. The passwords
configured after you restore the display mode to
auto
by using
local-user password-display-mode
auto
, however, are displayed as defined by
password
.
•
The
access-limit
command configured for a local user takes effect only in the case of local
accounting.
•
If the user interface authentication mode (set by
authentication-mode
in user interface view) is AAA
(
scheme
), the commands that a login user can use after login depend on the privilege level
authorized to the user. If the user interface authentication mode is password (
password
) or no
authentication (
none
), the commands that a login user can use after login depend on the level
configured for the user interface (set by
user privilege level
in user interface view). For an SSH user
using publickey authentication, the commands that are available depend on the level configured for
the user interface. For more information about user interface authentication mode and user interface
command level, see
Fundamentals Configuration Guide.
•
Configure the user profile authorization attribute in both local user view and ISP domain view. The
setting in local user view takes precedence. For more information about user profiles, see
"
."
