To Next Page

To Previous Page

4-4

Command Accounting Configuration Example

Network diagram

As shown in Figure 4-3, configure the commands that the login users execute to be recorded on the

HWTACACS server to control and monitor user operations.

Figure 4-3 Network diagram for configuring command accounting

Internet

Console Connection

Intranet

Host B

192.168.1.20/24

Host A

Host C

10.10.10.10/24

Device

HWTACAS server

192.168.2.20/24

Configuration procedure

# Enable the telnet service on Device.

<Device> system-view

[Device] telnet server enable

# Enable command accounting for users logging in through the console port.

[Device] user-interface aux 0

[Device-ui-aux0] command accounting

[Device-ui-aux0] quit

# Enable command accounting for users logging in through telnet or SSH.

[Device] user-interface vty 0 4

[Device-ui-vty0-4] command accounting

[Device-ui-vty0-4] quit

# Create a HWTACACS scheme named tac and configure the IP address and UDP port for the primary

authorization server for the scheme. Ensure that the port number be consistent with that on the

HWTACACS server. Set the shared key for authentication packets to expert for the scheme. Specify

Device to remove the domain name in the username sent to the HWTACACS server for the scheme.

[Device] hwtacacs scheme tac

[Device-hwtacacs-tac] primary accounting 192.168.2.20 49

[Device-radius-rad] key accounting expert

[Device-radius-rad] user-name-format without-domain

H3C S5120-EI Series User Manual

Other manuals for H3C S5120-EI Series