Users Guide

$6$5DdOHYg5$JCE1vMSmkQOrbh31U74PIPv7lyOgRmba1IxhkYibppMXs1KM4Y.gbTPcxyMP/PHUkMc5rdk/
ZLv9Sfv3ALtB61
Disable linuxadmin user
To disable or lock the linuxadmin user, use the system-user linuxadmin disable command in CONFIGURATION mode.
OS10(config)# system-user linuxadmin disable
To re-enable or unlock the linuxadmin user, use the no system-user linuxadmin disable command in CONFIGURATION
mode.
OS10(config)# no system-user linuxadmin disable
RADIUS authentication
To congure a RADIUS server for authentication, enter the server IP address or host name, and the key used to authenticate the OS10
switch on a RADIUS host. You can enter the authentication key in plain text or encrypted format. You can change the User Datagram
Protocol (UDP) port number on the server.
• Congure a RADIUS authentication server in CONFIGURATION mode. By default, a RADIUS server uses UDP port 1812.
radius-server host {hostname | ip-address} key {0 authentication-key | 9 authentication-key
| authentication-key} [auth-port port-number]
To congure more than one RADIUS server, re-enter the radius-server host command multiple times. If you congure multiple
RADIUS servers, OS10 attempts to connect in the order you congured them. An OS10 switch connects with the congured RADIUS
servers one at a time, until a RADIUS server responds with an accept or reject response. The switch tries to connect with a server for the
congured number of retransmit retries and timeout period.
Congure global settings for the timeout and retransmit attempts allowed on RADIUS servers. By default, OS10 supports three RADIUS
authentication attempts and times out after ve seconds. No source interface is congured. The default VRF instance is used to contact
RADIUS servers.
NOTE
: You cannot congure both a non-default VRF instance and a source interface at the same time for RADIUS
authentication.
NOTE: A RADIUS server congured with a host name is not supported on a non-default VRF.
• Congure the number of times OS10 retransmits a RADIUS authentication request in CONFIGURATION mode, from 0 to 100 retries;
the default is 3.
radius-server retransmit retries
• Congure the timeout period used to wait for an authentication response from a RADIUS server in CONFIGURATION mode, from 0 to
1000 seconds; the default is 5.
radius-server timeout seconds
• (Optional) Specify an interface whose IP address is used as the source IP address for user authentication with RADIUS servers in
CONFIGURATION mode. By default, no source interface is congured. OS10 selects the source IP address of any interface from which
a packet is sent to a RADIUS server.
An interface may have two IPv4 addresses and multiple IPv6 addresses. The selected OS10 source interface matches the version of the
RADIUS server IP address: IPv4 or IPv6.
– For an IPv4 RADIUS server, the primary IPv4 address is used.
– For an IPv6 server, any of the global IPv6 addresses congured on the interface are used.
– If no address of the same IP version as the RADIUS server is congured, RADIUS authentication is performed with no source
interface, using the IP address of the management interface. The management IP address serves as the RADIUS network access
server (NAS) IP address on the switch.
ip radius source-interface interface
On the RADIUS server, you must update the congured IP routes using the Linux command line so that the source interface routes
match the NAS IP route.
Security
935