华为交换机Console口属性配置

华为交换机Console口属性配置

一、设置通过账号和密码（AAA验证）登陆Console口

1. 进入 Console 用户界面视图

<Huawei>system-view
[Huawei]user-interface console 0
[Huawei-ui-console0]

1. 在 Console 用户界面视图下，设置用户验证方式为 AAA 验证

[Huawei-ui-console0]authentication-mode ?
  aaa       AAA authentication
  none      Login without checking           //无需验证直接登陆console口
  password  Authentication through the password of a user terminal interface       //只通过输入密码登陆console口

[Huawei-ui-console0]authentication-mode aaa

1. 进入AAA视图，配置登 Console 口的账号和密码

[Huawei-ui-console0]q
[Huawei]aaa
[Huawei-aaa]local-user ?
  STRING<1-64>  User name, in form of 'user@domain'. Can use wildcard '*',
                while displaying and modifying, such as *@isp,user@*,*@*.Can
                not include invalid character / \ : * ? " < > | @ '

[Huawei-aaa]local-user admin ?
  access-limit   Set access limit of user(s)
  ftp-directory  Set user(s) FTP directory permitted
  idle-timeout   Set the timeout period for terminal user(s)
  password       Set password
  privilege      Set admin user(s) level
  service-type   Service types for authorized user(s)
  state          Activate/Block the user(s)

[Huawei-aaa]local-user admin password ?
  cipher  User password with cipher text      //以密文方式显示口令
  simple  User password with plain text       //以明文方式显示口令

[Huawei-aaa]local-user admin password cipher ?
  STRING<1-16>/<24>  The UNENCRYPTED/ENCRYPTED password string

[Huawei-aaa]local-user admin password cipher 123456
Info: Add a new user.

    //查看账户信息
[Huawei-aaa]display local-user
  ----------------------------------------------------------------------------
  User-name                      State  AuthMask  AdminLevel
  ----------------------------------------------------------------------------
  admin                          A      A         -
  ----------------------------------------------------------------------------
  Total 1 user(s)

1. 设置登陆 Console 的账号和密码的服务类型为 Console（terminal）类型

[Huawei-aaa]local-user admin ?
  access-limit   Set access limit of user(s)
  ftp-directory  Set user(s) FTP directory permitted
  idle-timeout   Set the timeout period for terminal user(s)
  password       Set password
  privilege      Set admin user(s) level
  service-type   Service types for authorized user(s)
  state          Activate/Block the user(s)

[Huawei-aaa]local-user admin service-type ?
  8021x     802.1x user
  bind      Bind authentication user
  ftp       FTP user
  http      Http user
  ppp       PPP user
  ssh       SSH user
  telnet    Telnet  user
  terminal  Terminal user
  web       Web authentication user
  x25-pad   X25-pad user

[Huawei-aaa]local-user admin service-type terminal ?
  8021x    802.1x user
  bind     Bind authentication user
  ftp      FTP user
  http     Http user
  ppp      PPP user
  ssh      SSH user
  telnet   Telnet  user
  web      Web authentication user
  x25-pad  X25-pad user
  <cr>     

[Huawei-aaa]local-user admin service-type terminal

    //再次查看账户信息
[Huawei-aaa]display local-user
  ----------------------------------------------------------------------------
  User-name                      State  AuthMask  AdminLevel
  ----------------------------------------------------------------------------
  admin                          A      M         -
  ----------------------------------------------------------------------------
  Total 1 user(s)

    //保存配置
<Huawei>save
The current configuration will be written to the device.
Are you sure to continue?[Y/N]y      //输入y,确认
Now saving the current configuration to the slot 0.
Apr  6 2021 16:09:10-08:00 Huawei %%01CFM/4/SAVE(l)[55]:The user chose Y when de
ciding whether to save the configuration to the device.
Save the configuration successfully.

二、设置只通过密码登陆 Console 口

1. 进入 Console 用户界面视图，设置只通过密码登陆 Console 口模式

<Huawei>system-view
[Huawei]user-interface console 0
[Huawei-ui-console0]authentication-mode password

1. 设置验证密码，输入的密码可以是明文或密文

[Huawei-ui-console0]set authentication ?
  password  Set the password for a user interface

[Huawei-ui-console0]set authentication password ?
  cipher  Set the password with cipher text        //以密文方式显示口令
  simple  Set the password in plain text           //以明文方显示口令

[Huawei-ui-console0]set authentication password cipher ?
  STRING<1-16>/<24>  Plain text/cipher text password

[Huawei-ui-console0]set authentication password cipher 123456

    //查看操作的步骤
[Huawei-ui-console0]display this
#
user-interface con 0
 authentication-mode password
 set authentication password cipher yLST2)ywQ@:.`&R&e7S(bTi#          //密码加密处理了
user-interface vty 0 4
#
return

    //保存配置
<Huawei>save
The current configuration will be written to the device.
Are you sure to continue?[Y/N]y      //输入y,确认
Now saving the current configuration to the slot 0.
Apr  6 2021 16:09:10-08:00 Huawei %%01CFM/4/SAVE(l)[55]:The user chose Y when de
ciding whether to save the configuration to the device.
Save the configuration successfully.

1. 输入的密码可以是明文或者密文，当不指定cipher password参数时，将采用交互方式输入明文密码；
2. 当指定cipher password参数时，既可以输入明文密码也可以输入密文密码，但都将以密文形式保存在配置文件中。
3. 当用户输入密码时，直接以明文形式输入存在安全风险，建议用户以交互式方式输入。

三、设置直接登陆 Console 口，无需验证

<Huawei>system-view
[Huawei]user-interface console 0
[Huawei-ui-console0]authentication-mode none

四、配置Console用户界面的用户优先级

<Huawei>system-view
[Huawei]user-interface console 0
[Huawei-ui-console0]user privilege level ?
  INTEGER<0-15>  Set a priority
[Huawei-ui-console0]user privilege level 3

• 用户级别和命令级别对应关系表：

用户级别	命令级别	级别名称	说明
0	0	参观级	网络诊断工具命令（ping、tracert）、从本设备出发访问外部设备的命令（Telnet客户端）等。
1	0，1	监控级	用于系统维护，包括display等命令。 说明：并不是所有display命令都是监控级，比如display current-configuration命令和display saved-configuration命令是3级管理级。
2	0，1，2	配置级	业务配置命令，包括路由、各个网络层次的命令，向用户提供直接网络服务。
3~15	0，1，2，3	管理级	用于系统基本运行的命令，对业务提供支撑作用，包括文件系统、FTP、TFTP下载、用户管理命令、命令级别设置命令； 用于业务故障诊断的debugging命令等。

1. 用户可以配置用户优先级，实现对不同用户访问设备权限的限制，增加设备管理的安全性。
2. 用户的优先级分为16个级别，级别标识为0～15，标识越高则优先级越高。
3. 用户的优先级和命令的优先级是相对应的，即用户只能使用等于或低于自己级别的命令。
4. 缺省情况下，Console口用户界面对应的默认命令访问级别是15。
5. 如果用户界面下配置的命令级别访问权限与用户名本身对应的操作权限冲突，以用户名本身对应的级别为准。

五、查看 Console 用户界面信息

<Huawei>display user-interface console 0
  Idx  Type     Tx/Rx      Modem Privi ActualPrivi Auth  Int
+ 0    CON 0    9600       -     3     3           N     -
  +    : Current UI is active.
  F    : Current UI is active and work in async mode.
  Idx  : Absolute index of UIs.
  Type : Type and relative index of UIs.
  Privi: The privilege of UIs.
  ActualPrivi: The actual privilege of user-interface.
  Auth : The authentication mode of UIs.
      A: Authenticate use AAA.
      N: Current UI need not authentication.
      P: Authenticate use current UI's password.
  Int  : The physical location of UIs.

六、清除已经保存的配置

<Huawei>reset saved-configuration
Warning: The action will delete the saved configuration in the device.
The configuration will be erased to reconfigure. Continue? [Y/N]:y        //输入y，确认清除
Warning: Now clearing the configuration in the device.
Apr  6 2021 16:29:00-08:00 Huawei %%01CFM/4/RST_CFG(l)[0]:The user chose Y when
deciding whether to reset the saved configuration.
Info: Succeeded in clearing the configuration in the device.

    //配置虽然清除了，但是配置的账户和密码还有效，重启之后仍任需要密码
<Huawei>system-view
[Huawei]aaa
[Huawei-aaa]display local-user
  ----------------------------------------------------------------------------
  User-name                      State  AuthMask  AdminLevel
  ----------------------------------------------------------------------------
  admin                          A      M         -
  ----------------------------------------------------------------------------
  Total 1 user(s)
[Huawei-aaa]undo local-user admin      //删除账户包括密码
[Huawei-aaa]display local-user
  Total 0 user(s)

<Huawei>reboot

或者设置无需验证登陆 Console 口
[Huawei]user-interface console 0
[Huawei-ui-console0]authentication-mode none