Configuring Authentication To Access Privileged Exec Mode (The Enable Command); Configuring Authentication For The Enable Command - Cisco PIX 500 Series Configuration Manual

Configuring AAA for System Administrators
Before the security appliance can authenticate a Telnet, SSH, or HTTP user, you must first configure
Note
access to the security appliance using the telnet, ssh, and http commands. These commands identify the
IP addresses that are allowed to communicate with the security appliance.
To authenticate users who access the CLI, enter the following command:
hostname(config)# aaa authentication {telnet | ssh | http | serial} console {LOCAL |
server_group [LOCAL]}
The http keyword authenticates the ASDM client that accesses the security appliance using HTTPS. You
only need to configure HTTP authentication if you want to use a AAA server. By default, ASDM uses
the local database for authentication even if you do not configure this command. HTTP management
authentication does not support the SDI protocol for a AAA server group.
If you use a AAA server group for authentication, you can configure the security appliance to use the
local database as a fallback method if the AAA server is unavailable. Specify the server group name
followed by LOCAL (LOCAL is case sensitive). We recommend that you use the same username and
password in the local database as the AAA server because the security appliance prompt does not give
any indication which method is being used.
You can alternatively use the local database as your main method of authentication (with no fallback) by
entering LOCAL alone.
Configuring Authentication To Access Privileged EXEC Mode (the enable
Command)
You can configure the security appliance to authenticate users with a AAA server or the local database
when they enter the enable command. Alternatively, users are automatically authenticated with the local
database when they enter the login command, which also accesses privileged EXEC mode depending on
the user level in the local database.
This section includes the following topics:
•
•

Configuring Authentication for the enable Command

You can configure the security appliance to authenticate users when they enter the enable command. If
you do not authenticate the enable command, when you enter enable, the security appliance prompts for
the system enable password (set by the enable password command), and you are no longer logged in as
a particular user. Applying authentication to the enable command maintains the username. This feature
is particularly useful when you perform command authorization, where usernames are important to
determine the commands a user can enter.
To authenticate users who enter the enable command, enter the following command:
hostname(config)# aaa authentication enable console {LOCAL | server_group [LOCAL]}
The user is prompted for the username and password.
Cisco Security Appliance Command Line Configuration Guide
40-6
Configuring Authentication for the enable Command, page 40-6
Authenticating Users Using the Login Command, page 40-7
Chapter 40 Managing System Access
OL-12172-03