A-20
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
AppendixA System Architecture
MainApp
The Logger can control what log messages are generated by each application by controlling the logging
severity for different logging zones. You would only access the individual-zone-control of the logger
service at the request and supervision of a TAC engineer or developer. For troubleshooting purposes,
TAC might request that you turn on debug logging.
AuthenticationApp
This section describes the AuthenticationApp, and contains the following topics:
•
Understanding the AuthenticationApp, page A-20
•
Authenticating Users, page A-20
•
Configuring Authentication on the Sensor, page A-20
•
Managing TLS and SSH Trust Relationships, page A-21

Understanding the AuthenticationApp

The AuthenticationApp has the following responsibilities:
•
To authenticate the identity of a user
•
To administer the accounts, privileges, keys, and certificates of the user
•
To configure which authentication methods are used by the AuthenticationApp and other access
services on the sensor

Authenticating Users

You must configure authentication on the sensor to establish appropriate security for user access. When
you install a sensor, an initial cisco account with an expired password is created. A user with
administrative access to the sensor accesses the sensor through the CLI or an IPS manager, such as the
IDM or the ASDM, by logging in to the sensor using the default administrative account (cisco). In the
CLI, the administrator is prompted to change the password. IPS managers initiate a
setEnableAuthenticationTokenStatus control transaction to change the password of an acc ount.
Through the CLI or an IPS manager, the administrator configures which authentication method is used,
such as username and password or an SSH authorized key. The application servicing the administrator
initiates a setAuthenticationConfig control transaction to establish the authentication configuration.
The authentication configuration includes a login attempt limit value that is used to specify how account
locking is handled. Account locking is invoked when the number of consecutive failed login attempts for
a given account exceeds the login attempt limit value. After an account is locked, all further attempts to
log in to that account are rejected. The account is unlocked by resetting the authentication token of the
account using the setEnableAuthenticationTokenStatus control transaction. The account locking feature
is disabled when the login attempt limit value is set to zero.
The administrator can add additional user accounts either through the CLI or an IPS manager.

Configuring Authentication on the Sensor

When a user tries to access the sensor through a service such as web server or the CLI, the identity of
the user must be authenticated and the privileges of the user must be established. The service that is
providing access to the user initiates an execAuthenticateUser control transaction request to the