CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.2

Step 1

ciscoasa(config)# username exampleuser1 privilege 1

Creates the user account. The username user name keyword is a string from 4 to 64 characters long.

The password password keyword is a string from 3 to 32 characters long. The privilege level argument sets the privilege level, which ranges from 0 to 15. The default is 2. This privilege level is used with command authorization.

The nopassword keyword creates a user account with no password.

The encrypted keyword indicates that the password is encrypted. When you define a password in the username command, the ASA encrypts it when it saves it to the configuration for security purposes. When you enter the show running-config command, the username command does not show the actual password; it shows the encrypted password followed by the encrypted keyword. For example, if you enter the password “test,” the show running-config output would appear as something similar to the following:

The only time you would actually enter the encrypted keyword at the CLI is if you are cutting and pasting a configuration file for use in another ASA, and you are using the same password.

Step 2

(Optional) Configures username attributes. The username argument is the username that you created in Step 1.

By default, VPN users that you add with this command have no attributes or group policy association. You must configure all values explicitly using the username attributes command. For more information, see the VPN configuration guide.

Step 3

ciscoasa(config-username)# service-type admin

(Optional) Configures the user level if you configured management authorization using the aaa authorization exec command (see Limiting User CLI and ASDM Access with Management Authorization). The admin keyword allows full access to any services specified by the aaa authentication console LOCAL commands. The admin keyword is the default.

The nas-prompt keyword allows access to the CLI when you configure the aaa authentication { telnet | ssh | serial} console command, but denies ASDM configuration access if you configure the aaa authentication http console command. ASDM monitoring access is allowed. If you enable authentication with the aaa authentication enable console command, the user cannot access privileged EXEC mode using the enable command (or the login command).

The remote-access keyword denies management access. The user cannot use any services specified by the aaa authentication console commands (excluding the serial keyword; serial access is allowed).

Step 4

ciscoasa(config-username)# ssh authentication pkf

Enter an SSH public key formatted file.

End with the word "quit" on a line by itself:

---- BEGIN SSH2 PUBLIC KEY ----

Comment: "4096-bit RSA, converted by xxx@xxx from OpenSSH"

AAAAB3NzaC1yc2EAAAADAQABAAACAQDNUvkgza37lB/Q/fljpLAv1BbyAd5PJCJXh/U4LO

hleR/qgIROjpnFaS7Az8/+sjHmq0qXC5TXkzWihvRZbhefyPhPHCi0hIt4oUF2ZbXESA/8

jUT4ehXIUE7FrChffBBtbD4d9FkV8A2gwZCDJBxEM26ocbZCSTx9QC//wt6E/zRcdoqiJG

p4ECEdDaM+56l+yf73NUigO7wYkqcrzjmI1rZRDLVcqtj8Q9qD3MqsV+PkJGSGiqZwnyIl

QbfYxXHU9wLdWxhUbA/xOjJuZ15TQMa7KLs2u+RtrpQgeTGTffIh6O+xKh93gwTgzaZTK4

CQ1kuMrRdNRzza0byLeYPtSlv6Lv6F6dGtwlqrX5a+w/tV/aw9WUg/rapekKloz3tsPTDe

p866AFzU+Z7pVR1389iNuNJHQS7IUA2m0cciIuCM2we/tVqMPYJl+xgKAkuHDkBlMS4i8b

Wzyd+4EUMDGGZVeO+corKTLWFO1wIUieRkrUaCzjComGYZdzrQT2mXBcSKQNWlSCBpCHsk

/r5uTGnKpCNWfL7vd/sRCHyHKsxjsXR15C/5zgHmCTAaGOuIq0Rjo34+61+70PCtYXebxM

Wwm19e3eH2PudZd+rj1dedfr2/IrislEBRJWGLoR/N+xsvwVVM1Qqw1uL4r99CbZF9NghY

NRxCQOY/7K77II==

---- END SSH2 PUBLIC KEY ----quit

INFO: Import of an SSH public key formatted file SUCCEEDED.

ciscoasa(config-username)#

Enables public key authentication for SSH connections to the ASA on a per-user basis. You can specify a public key file (PKF) formatted key (the pkf keyword) or a Base64 key (the publickey keyword).

For a publickey, the key is a Base64-encoded public key. You can generate the key using any SSH key generation software (such as ssh keygen) that can generate SSH-RSA raw keys (with no certificates).

For a pkf key, you are prompted to paste in a PKF formatted key, up to 4096 bits. Use this format for keys that are too large to paste inline in Base64 format. For example, you can generate a 4096-bit key using ssh keygen, then convert it to PKF, and use the pkf keyword to be prompted for the key.

Note You can use the pkf option with failover, but the PKF key is not automatically replicated to the standby system. You must enter the write standby command to synchronize the PKF key.

When you view the key on the ASA using the show running-config username command, the key is encrypted using a SHA-256 hash. Even if you entered the key as pkf, the ASA hashes the key, and shows it as a hashed publickey. If you need to copy the key from show output, specify the publickey type with the hashed keyword.

Step 5

(Optional) If you are using this username for VPN authentication, you can configure many VPN attributes for the user. For more information, see the VPN configuration guide.