읽기 전용 작업 그룹
설정
읽기 전용 액세스 권한을 가진 Aggregation Services Router 9000(ASR9K)에서 사용자를 생성하려면 읽기 전용 권한을 가진 작업 그룹을 정의하고 해당 작업 그룹으로 사용자 그룹을 생성한 다음 새로 생성된 그룹을 사용자에게 연결해야 합니다.
작업 그룹 만들기
다음은 사용자가 show 명령을 실행할 수 있는 작업입니다.
RP/0/RSP1/CPU0:ASR9000# show run taskgroup taskgroup_read_only taskgroup taskgroup_read_only task read fr task read li task read aaa task read acl task read atm task read bfd task read bgp task read cdp task read cef task read cgn task read eem task read nps task read pbr task read ppp task read qos task read rib task read rip task read sbc task read ancp task read bcdl task read boot task read diag task read dwdm task read hdlc task read hsrp task read ipv4 task read ipv6 task read isis task read lisp task read lpts task read ospf task read ouni task read rcmd task read snmp task read vlan task read vpdn task read vrrp task read admin task read eigrp task read l2vpn task read bundle task read crypto task read fabric task read static task read sysmgr task read system task read tunnel task read drivers task read logging task read monitor task read mpls-te task read netflow task read network task read pos-dpt task read firewall task read mpls-ldp task read pkg-mgmt task read call-home task read fault-mgr task read interface task read inventory task read multicast task read route-map task read sonet-sdh task read transport task read ext-access task read filesystem task read tty-access task read config-mgmt task read ip-services task read mpls-static task read route-policy task read host-services task read basic-services task read config-services task read ethernet-services !
사용자 그룹 생성
작업 그룹은 사용자 그룹에 적용됩니다. usergroup_read_only라는 사용자 그룹을 만들었습니다.
RP/0/RSP1/CPU0:ASR9000# show run usergroup usergroup_read_only usergroup usergroup_ready_only taskgroup taskgroup_read_only ! end-group
옵션 1. 로컬 사용자 생성
로컬 사용자를 생성하고 사용자 그룹을 적용합니다.
RP/0/RSP1/CPU0:ASR9000# show run username tyler username tyler group usergroup_read_only secret 5 $1$wTwU$CdHKzfRJlJ7kDvJa7NWdi. !
확인
명령 작업 표시
RP/0/RSP1/CPU0:ASR9000# show clock 13:42:03.811 UTC Thu Jun 30 2016
RP/0/RSP1/CPU0:ASR9000# show run Building configuration... !! IOS XR Configuration 5.1.3 ! hostname ASR9000 [output omitted]
구성 시도 실패
구성하기 위한 액세스를 차단할 수는 없지만, 시도한 모든 구성이 실패합니다.
루프백 인터페이스 생성과 같은 기본 컨피그레이션은 실패합니다.
RP/0/RSP1/CPU0:ASR9000# conf t
RP/0/RSP1/CPU0:ASR9000(config)# int loopback 103
% This command is not authorized
BGP 제거도 실패합니다.
RP/0/RSP1/CPU0:ASR9000# configure
RP/0/RSP1/CPU0:ASR9000(config)# no router bgp 65530
% This command is not authorized
그룹 할당 확인
로그인한 사용자가 usergroup_read_only의 구성원입니다.
RP/0/RSP1/CPU0:ASR9000# show user group usergroup_read_only
작업 할당 확인
이 사용자는 지정된 작업에 대해 READ에만 액세스할 수 있습니다.
RP/0/RSP1/CPU0:ASR9000# show user tasks Task: aaa : READ Task: acl : READ Task: admin : READ Task: ancp : READ Task: atm : READ Task: basic-services : READ Task: bcdl : READ Task: bfd : READ Task: bgp : READ Task: boot : READ Task: bundle : READ Task: call-home : READ Task: cdp : READ Task: cef : READ Task: cgn : READ Task: config-mgmt : READ Task: config-services : READ Task: crypto : READ Task: diag : READ Task: drivers : READ Task: dwdm : READ Task: eem : READ Task: eigrp : READ Task: ethernet-services : READ Task: ext-access : READ Task: fabric : READ Task: fault-mgr : READ Task: filesystem : READ Task: firewall : READ Task: fr : READ Task: hdlc : READ Task: host-services : READ Task: hsrp : READ Task: interface : READ Task: inventory : READ Task: ip-services : READ Task: ipv4 : READ Task: ipv6 : READ Task: isis : READ Task: l2vpn : READ Task: li : READ Task: lisp : READ Task: logging : READ Task: lpts : READ Task: monitor : READ Task: mpls-ldp : READ Task: mpls-static : READ Task: mpls-te : READ Task: multicast : READ Task: netflow : READ Task: network : READ Task: nps : READ Task: ospf : READ Task: ouni : READ Task: pbr : READ Task: pkg-mgmt : READ Task: pos-dpt : READ Task: ppp : READ Task: qos : READ Task: rcmd : READ Task: rib : READ Task: rip : READ Task: route-map : READ Task: route-policy : READ Task: sbc : READ Task: snmp : READ Task: sonet-sdh : READ Task: static : READ Task: sysmgr : READ Task: system : READ Task: transport : READ Task: tty-access : READ Task: tunnel : READ Task: vlan : READ Task: vpdn : READ Task: vrrp : READ
참조
지원 포럼 - ASR9000/XR Using Taskgroups and understanding Priv levels and authorization - Xander's Guide
피드백