问题描述：
sw交换机做了radius认证后，SSH可以正常登录，但是设备的cons口密码无法通过认证
下面是cons口登录设备的日志，
<HBY321-AS5130-17111>*Apr 9 13:29:43:958 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: PAM_RADIUS: Processing RADIUS authentication.
*Apr 9 13:29:43:958 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Processing AAA request data.
*Apr 9 13:29:43:959 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Got request data successfully, primitive: authentication.
*Apr 9 13:29:43:959 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Getting RADIUS server info.
*Apr 9 13:29:43:959 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Got RADIUS server info successfully.
*Apr 9 13:29:43:959 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Created request context successfully.
*Apr 9 13:29:43:960 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Created request packet successfully, dstIP: 10.200.3.170, dstPort: 1812, VPN instance: --(public), socketFd: 26, pktID: 159.
*Apr 9 13:29:43:961 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Added packet socketfd to epoll successfully, socketFd: 26.
*Apr 9 13:29:43:961 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Mapped PAM item to RADIUS attribute successfully.
*Apr 9 13:29:43:962 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Got RADIUS username format successfully, format: 2.
*Apr 9 13:29:43:962 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Added attribute user-name successfully, user-name: liuyu.
*Apr 9 13:29:43:962 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Filled RADIUS attributes in packet successfully.
*Apr 9 13:29:43:962 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Composed request packet successfully.
*Apr 9 13:29:43:963 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Created response timeout timer successfully.
*Apr 9 13:29:43:963 2024 HBY321-AS5130-17111 RADIUS/7/PACKET:
User-Name="liuyu"
NAS-Identifier="HBY321-AS5130-17111"
NAS-Port-Type=Virtual
User-Password=******
Acct-Session-
Service-Type=Login-User
NAS-IP-Address=172.20.171.11
H3c-Product-
H3c-Nas-Startup-Timestamp=1712639474
*Apr 9 13:29:43:964 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: PAM_RADIUS: Sent authentication request successfully.
*Apr 9 13:29:43:964 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Sent request packet successfully.
*Apr 9 13:29:43:965 2024 HBY321-AS5130-17111 RADIUS/7/PACKET:
01 9f 00 a1 d3 3c 97 5c d8 b3 b7 e1 7c 74 d4 18
bc f1 2c a2 01 07 6c 69 75 79 75 20 15 48 42 59
33 32 31 2d 41 53 35 31 33 30 2d 31 37 31 31 31
3d 06 00 00 00 05 02 12 c3 6d 4e 17 f0 f3 7d 94
6b 74 56 7e 8b e0 4e 2e 2c 28 30 30 30 30 30 30
30 31 32 30 32 34 30 34 30 39 30 35 32 39 34 33
30 30 30 30 30 30 30 32 30 38 31 30 30 35 31 33
06 06 00 00 00 01 04 06 ac 14 ab 0b 1a 19 00 00
63 a2 ff 13 48 33 43 20 53 35 31 33 30 53 2d 35
32 53 2d 48 49 1a 0c 00 00 63 a2 3b 06 66 14 cd
f2
*Apr 9 13:29:43:965 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Sent request packet and create request context successfully.
*Apr 9 13:29:43:966 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Added request context to global table successfully.
*Apr 9 13:29:43:966 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Processing AAA request data.
*Apr 9 13:29:43:967 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Reply SocketFd recieved EPOLLIN event.
*Apr 9 13:29:43:968 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Received reply packet succuessfully.
*Apr 9 13:29:43:968 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Found request context, dstIP: 10.200.3.170, dstPort: 1812, VPN instance: --(public), socketFd: 26, pktID: 159.
*Apr 9 13:29:43:969 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: The reply packet is valid.
*Apr 9 13:29:43:969 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Decoded reply packet successfully.
*Apr 9 13:29:43:969 2024 HBY321-AS5130-17111 RADIUS/7/PACKET:
Service-Type=Administrative-User
Login-Service=50
Hw-Exec-Privilege=15
3Com-User-Access-Level=3Com-Administrator
H3c-Exec-Privilege=3
Cisco-AVPair="shell:priv-lvl=15"
*Apr 9 13:29:43:970 2024 HBY321-AS5130-17111 RADIUS/7/PACKET:
02 9f 00 5d 6d 85 13 45 4c ab d7 8a 6a 29 55 cd
e8 19 c0 a8 06 06 00 00 00 06 0f 06 00 00 00 32
1a 0c 00 00 07 db 1d 06 00 00 00 0f 1a 0c 00 00
00 2b 01 06 00 00 00 03 1a 0c 00 00 63 a2 1d 06
00 00 00 03 1a 19 00 00 00 09 01 13 73 68 65 6c
6c 3a 70 72 69 76 2d 6c 76 6c 3d 31 35
*Apr 9 13:29:43:970 2024 HBY321-AS5130-17111 RADIUS/7/ERROR: The login-service type that server assigned does not match with the access type.
*Apr 9 13:29:43:971 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: PAM_RADIUS: Fetched authentication reply-data successfully, resultCode: 1
*Apr 9 13:29:43:971 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: PAM_RADIUS: Received authentication reply message, resultCode: 1
*Apr 9 13:29:43:974 2024 HBY321-AS5130-17111 RADIUS/7/EVENT: Sent reply message successfully.
组网及组网描述：
radius scheme aaa
primary authentication x.x.x.x
primary accounting x.x.x.x
key authentication simple xxxx
key accounting simple xxx
user-name-format without-domain
timer response-timeout 1
retry 3
domain ict
authentication login radius-scheme aaa local
authorization login radius-scheme aaa local
accounting login radius-scheme aaa local
user-interface vty 0 4
authentication-mode scheme
protocol inbound ssh
idle-timeout 5 0
user-interface aux 0
undo set authentication password
authentication-mode scheme
domain default enable ict
- 2024-04-09提问
- 举报
-
(0)
最佳答案
您好，参考手册
V7开启SSH服务和创建登录账号密码
2.1 配置步骤
# 进入系统视图，并开启ssh服务，默认开启。
<H3C> system-view
[H3C] SSH server enable
# 创建本地账号abc，密码为123456，权限级别为network-admin。//如果现场同一个本地用户既需要通过ssh登录，又需要console登录，则服务器类型需要添加 terminal
[H3C] local-user abc
[H3C-luser-abc] password simple 123456
[H3C-luser-abc] service-type ssh terminal
[H3C-luser-abc] authorization-attribute user-role network-admin
[H3C-luser-abc] quit
# 配置VTY接口认证模式为scheme模式（用户名+密码认证）。用于ssh登录
[H3C] line vty 0 4
[H3C-ui-vty0-4] authentication-mode scheme //另两种认证模式为None（无密码）和Password（单密码）
[H3C-ui-vty0-4] quit
- 2024-04-09回答
- 评论(0)
- 举报
-
(0)
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论