3-29
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter3 Setting Up the Sensor
Configuring Authentication and User Parameters
Step 4
Specify a password when prompted. A valid password is 8 to 32 characters long. All characters except
space are allowed. If a service account already exists for this sensor, the following error is displayed and
no service account is created.
Error: Only one service account may exist
Step 5
Exit configuration mode.
sensor(config)# exit
sensor#
When you use the service account to log in to the CLI, you receive this warning.
************************ WARNING *******************************************************
UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS PROHIBITED. This account is intended to be
used for support and troubleshooting purposes only. Unauthorized modifications are not
supported and will require this device to be reimaged to guarantee proper operation.
****************************************************************************************
The Service Account and RADIUS Authentication
If you are using RADIUS authentication and want to create and use a service account, you must create
the service account both on your sensor and on the RADIUS server. You must use local authentication
to access the service account on the sensor. The service account must be created manually as a local
account on the sensor. Then when you configure RADIUS authentication, the service account must also
be configured manually on the RADIUS server with the accept message set to ip-role=service.
When you log in to the service account, you are authenticated against both the sensor account and the
RADIUS server account. By whatever method you use to access the service account—serial console
port, direct monitor/keyboard (for sensors that support it), or a network connection, such as SSH or
Telnet—you have to log in using local authentication.
RADIUS Authentication Functionality and Limitations
The current AAA RADIUS implementation has the following functionality and limitations:
•
Authentication with a RADIUS server—However, you cannot change the password of the RADIUS
server from the IPS.
•
Authorization—You can perform role-based authorization by specifying the IPS role of the user on
the RADIUS server.
•
Accounting—The login attempts of the user and the configuration chan ges are logged as events
locally on the IPS. However, these account messages are not communicated to the RADIUS server.
Configuring Passwords
Use the password command to update the password on the local sensor. You can also use this command
to change the password for an existing user or to reset the password for a locked account. A valid
password is 8 to 32 characters long. All characters except space are allowed.