四川电信CRS-1培训教材.ppt

Root System User Creating, modifying or deleting root system users should be done at the highest privilege of the security server. A user is termed as an root system user if that user is made a member of the root system user group. If the user is configured as a member of the root system user group, it does not make sense for the user to be a member of any other user group. The user group designated as owner group should also be declared so in the security server. This helps to avoid configuring task permissions for such a group (which is not necessary because root system users have predefined task permissions). LR Owner A user is termed as an LR owner if he/she is made a member of a the LR owner group. If made so, the user cannot be made member of any other group since the permissions of a LR Owner is predefined. LR User LR users can be created and made member of multiple user groups. The effective task permission set is derived by making a union of all the permissions enabled by all the user groups. User Group Management User groups have unique name across the domain of the security server. User groups, however, are qualified with a list of logical routers that can refer to it. User groups may be imported from the HFR configuration. AAA data such as users, user groups and task groups can be stored locally within a logical router. The data is stored in the in-memory database, SysDB, and persisted in the configuration file. The stored passwords must be encrypted. The local database may also have X.509 certificates (for SSL/TLS). Note that this database is local to the specific logical router in which it is stored, and the defined users or groups are not visible to other logical routers in the same HFR system. Remote AAA Configuration Products such as Cisco Secure can be used to administer the shared or external AAA database. The HFR communicates with the remote AAA server using standard IP-based security protocol (such as TACACS+). The security server sh