User's Manual

Fortress ES-Series CLI Guide: Network Security, Authentication and Auditing
154
NOTE: When using
an external authen-
tication server, user and
(when applicable) device
authentication settings
are configured in the
external application.
Set individual users’ session timeouts in minutes, from 1 to 200
(inclusive). Set individual users’ idle timeouts in minutes from
1
to
720 (inclusive).
User accounts are
active by default. To disable a user’s
account set
-admin to inactive .
User accounts have no administrative privileges on any Mesh
Point by default, as configured by an
-adminauth value of
none . The Mesh Point’s user authentication database can
however be used to authenticate administrators on a remote
Mesh Point (or on the current Mesh Point) when it is configured
for
radius administrative authentication through the set
account
command (refer to Section 2.2.1). The level of
administrative privileges of an administrator authenticated in
this way are determined by the
role specified by the
-adminauth value. A value of administrator grants full
management access,
maintenance grants view-only and limited
administrative permissions, and
logviewer confines
permissions to limited system-log viewing (as described in
greater detail in Section 2.2).
Once a user account has been established, you cannot change
the username associated with it. Use the
-name switch with the
update command to reconfigure the account of the user you
specify. The same switches and arguments used with
add
userauth
(above) can be used to edit other account settings:
# update userauth -name <username> -password <userpw> -passwordConfirm <userpw>
-idletimeout 1–720 -sestimeout 1—200 -fullname <“Full Username”> -admin active|inactive
-adminauth none|administrator|maintenance|logviewer
You can delete a specified user account or all configured user
accounts with the
del command:
# del userauth -all|-name <username>
You must be logged on to an administrator -level account to
change configuration settings (refer to Section 2.2).
4.5.4 Client Device Authentication
Local device authentication settings apply only to Secure Client
devices authenticating through the Mesh Point’s internal
authentication server. (Controller authentication of other
Fortress devices is covered in Section 4.6.2, below.)
When device authentication is enabled (Section 4.5.2.1), the
Mesh Point detects devices attempting to access the Mesh
Point’s encrypted zone and lists them for local authentication.
You can also manually add a device for internal RADIUS
authentication by entering its MAC address and Fortress
Device ID.