交通銀行分行安裝配置手冊(cè)version實(shí)施方案h

5，UCP（userchangeblepassword）軟件（附件一：CiscoACS1.1c：10Gd：26G附件一：CiscoACS1.1c：10Gd：26G1.2CiscoACS件安裝步IAS（recommended3．3．Yes，keepYes，keepexistingdatabase存，選擇后，再點(diǎn)擊下一步在進(jìn)行接下來(lái)的安裝4．ChooseDestinationLocation這里可以選擇ACS軟件安裝的目錄位置，這里要求統(tǒng)一把ACSD:\ciscoACS這里可以選擇ACS軟件安裝的目錄位置，這里要求統(tǒng)一把ACSD:\ciscoACSAlsotheWindowsUserDatabase,點(diǎn)擊全部選擇后點(diǎn)擊包括Action，Reboot，All，8．設(shè)置一個(gè)不少于8位的密碼用于對(duì)數(shù)據(jù)庫(kù)加密，密碼統(tǒng)一使用8．設(shè)置一個(gè)不少于8位的密碼用于對(duì)數(shù)據(jù)庫(kù)加密，密碼統(tǒng)一使用1.3配置1.3配置1.3.1ACS務(wù)器的管1.3.1ACS務(wù)器的管policy2002toPort配置步驟”進(jìn)入管理員控制頁(yè)面。如下圖2．點(diǎn)擊“AddAdministrator”submitIPaddressestoconnect（只允許列表中的IP地址可以訪問(wèn)）5.點(diǎn)擊“SessionPolicySessionidletimeout(minutes)5,設(shè)5分鐘后自動(dòng)超時(shí).Allowautomaticlocallogin(本機(jī)自動(dòng)登入)去除打1.3.2配置Log在控制頁(yè)面下點(diǎn)擊”1．Control”必須先在d:\下建1.3.2配置Log在控制頁(yè)面下點(diǎn)擊”1．Control”必須先在d:\下建立目錄acsconfig-backup。建立完成后點(diǎn)擊“submit”完成設(shè)記載所有級(jí)別信每天創(chuàng)建一個(gè)log“Restart2．點(diǎn)擊 ”進(jìn)入acs備份功能，要求ACS備份30天后刪除文定這里以“CSVFailedAttempts”為例，作設(shè)置說(shuō)明，其余依次類(lèi)推設(shè)置點(diǎn)擊“CSVFailed這里以“CSVFailedAttempts”為例，作設(shè)置說(shuō)明，其余依次類(lèi)推設(shè)置點(diǎn)擊“CSVFailedAttempts”用戶高級(jí)在控制頁(yè)面下點(diǎn)擊“”再點(diǎn)擊“選擇用戶高級(jí)在控制頁(yè)面下點(diǎn)擊“”再點(diǎn)擊“選擇TACACS＋屬性的設(shè)備：如下圖1.3.4shell令權(quán)限的（見(jiàn)下表1.3.4shell令權(quán)限的（見(jiàn)下表sessiondirexitquitdisconnect只有匹配以上命令才被ACS服務(wù)器點(diǎn)擊“shellCommandAuthset”后點(diǎn)擊“Add”允許運(yùn)行的命令列點(diǎn)擊“shellCommandAuthset”后點(diǎn)擊“Add”允許運(yùn)行的命令列speed、nospeed、duplex、noduplex、ip、只有匹配以上命令才被ACS服務(wù)器空無(wú)命令權(quán)限限制1.3.5網(wǎng)絡(luò)設(shè)備分組行舉例說(shuō)明設(shè)置的過(guò)程2．1.3.5網(wǎng)絡(luò)設(shè)備分組行舉例說(shuō)明設(shè)置的過(guò)程2．點(diǎn)擊“AddEntry”例說(shuō)明：點(diǎn)擊AAAClientIP：1.3.6用戶分組1.3.6用戶分組設(shè)”“submit2．點(diǎn)擊“EditSettings”shellshell注：在這里設(shè)定的功能就是控注：在這里設(shè)定的功能就是控制用戶組可以登陸哪些網(wǎng)絡(luò)設(shè)備組。比如某user進(jìn)入了一個(gè)test的用戶組里，這個(gè)組里允許訪問(wèn)core-devwan-dev兩個(gè)設(shè)備組，于是見(jiàn)圖設(shè)置。這樣test這個(gè)用戶組中的用戶僅僅可以登陸core-devwan-dev所包含的網(wǎng)設(shè)備了2一般使用第一種,通過(guò)時(shí)間的老化方式,Applypasswordchangerule打勾,對(duì)首次登入的用戶要求強(qiáng)制修改密碼.輸入“*”代表所有端口輸入所管轄的設(shè)備設(shè)置設(shè)置用戶enable登陸權(quán)1.3.7建立用1.3.7建立用1.4UCP（userchangeblepassword）軟1.4UCP（userchangeblepassword）軟1，在安裝文件目錄中有個(gè)ACSUtilities文件夾,內(nèi)包含Usernext3，編輯IIScomputermanagement中依目錄順序找到servicesandapplications>internet3，編輯IIScomputermanagement中依目錄順序找到servicesandapplications>internetinformationservices>defaultwebsite>securecgi-bin，按下圖修改其屬性，點(diǎn)擊OK。附件二、用戶密碼修改流方附件二、用戶密碼修改流方法一使用命令行方12方法IE方法IE服務(wù)器IP附件三、網(wǎng)絡(luò)設(shè)備配附件三、網(wǎng)絡(luò)設(shè)備配1.1CiscoIOS（12.05T以后）privilegeconfigurelevel15privilegeexeclevel15configureterminalusernameadminprivi15passcisco(此步驟必須先于aaa配置命令，否則無(wú)ACS失效用后門(mén)管理員登入可以進(jìn)入配置模式noaaanew-！authenticationloginbocomgrouptacacs+config-execbocomgrouptacacs+localcommands15bocomgrouptacacs+localaccountingcommands15bocomstart-stopgroupaaasession-id!!interfaceipaddress182.x.x.2iptacacssource-interfacetacacs-host182.x.x.xkeybocomXXX!configurelevel15noconfigurelevel15noaaaaaasession-id!!interfaceipaddress182.x.x.2iptacacssource-interfacetacacs-host182.x.x.xkeybocomXXX!configurelevel15noconfigurelevel15noaaalevel15level15linevty015execaccountingcommands15bocomloginauthenticationbocomauthorizationcommands15bocomIOS（12.05T以前）privilegeconfigurelevel15noprivilegeexeclevel15configureusernamelocaladminprivi15pass；定義“后門(mén)”管理員，用于AAA服務(wù)器失效時(shí)應(yīng)急措施(此命令必aaa當(dāng)ACSnoaaanew-!new-authenticationloginbocomtacacs+localauthorizationcommandstacacs+localaaaaccountingcommandsstart-程setlocaluseruserpoweruserpasswordpowerpassprivilege程setlocaluseruserpoweruserpasswordpowerpassprivilegesetlocaluserusernonenablepasswordpasswordenablepassauthenticationlogintacacsenableallsetaccountingcommandsenableallstop-onlysetauthorizationcommandsenablealltacacs+nonesettacacs settacacssettacacskey1.1.3火墻6.x7.xusernameadminpasswordadminprivilegeprivilegeconfigurelevel15noprivilegeconfigurelevel15noaaaprivilegeexeclevel15configureprivilegeexeclevel15configureterminalprivilegeexeclevel15configureaaa-serverbocomhost182.x.x.xaaa-serverbocomdeadtime10aaaauthenticationtelnetconsolebocomaaaauthenticationenableconsolebocomaaaauthorizationcommandbocomLOCALaaaaccountingprivilege15bocomaaaaccountingtelnetconsole1.1.4換機(jī)usernameadminprivilege15passwordadminaaanew-modelaaaauthenticationloginbocomgrouptacacs+localaaaauthorizationconfig-commandsaaaauthorizationexecbocomgrouptacacs+aaaauthorizationcommands15bocomgrouptacacs+localaaaaccountingcommands15bocomstart-stopgrouptacacs+iptacacssource-interfacevlaninterfaceipaddress182.x.x.x!tacacs-serverhost182.x.x.xtacacs-serverkeybocom012privilegeconfigurelevel15aaaprivilegeconfigurelevel15noaaaprivilegeconfigurelevel15noprivilegeexeclevel15configure!lineconlinevty0authorizationexecbocomloginauthenticationbocomauthorizationcommands15usernameadminprivilege15passwordnew-authenticationloginbocomgrouptacacs+config-execbocomgrouptacacs+15bocomgroupaccountingcommandsbocomstart-!iptacacssource-authorizationcommands15usernameadminprivilege15passwordnew-authenticationloginbocomgrouptacacs+config-execbocomgrouptacacs+15bocomgroupaccountingcommandsbocomstart-!iptacacssource-vlan!interfaceipaddress!tacacs-serverhost15tacacs-serverkeybocom012!execlevel15configurelinevty0loginauthenticationbocomauthorizationcommands15bocomauthorizationexecbocomaccountingcommands15bocom1.2華為網(wǎng)絡(luò)設(shè)備Quidway(config)#aaa-Quidway(config)#userservice-password7exec，execQuidway(config)#aaaauthenticationlogindefaultradiusQuidway(config)#radius-serverhost<ip_address>auth-<port_number>acct-portQuidwayQuidway(config)#aaaauthenticationlogindefaultradiusQuidway(config)#radius-serverhost<ip_address>auth-<port_number>acct-portQuidway(config)#radius-serverkey<keyQuidway(config)#radius-serverretransmitQuidway(config)#radius-servertimeoutCiscoPIX（Radius（推薦升級(jí)版本aaanew-aaaauthenticationtacacs-serverhosttacacs-serverkeylogindefaulttacacslocal1.4tacacs-server(inside)host<ACSipaddress><key>timeoutaaaauthenticationtelnetconsole附件四：應(yīng)急處理實(shí)施步附件四：應(yīng)急處理實(shí)施步命令：username(config)＃noaaanew-(config)＃privilegeexeclevel15configure(config)＃privilegeconfigurelevel15(config)＃usernameprivi15(config)＃aaanew-telnet（console，aux）Quidway(config)#aaaauthenticationlogindefaultradiusRadiusQuidway(config)#radius-serverhost<ip_address>auth-<port_number>acct-portRadiusIP（Quidway(config)#radius-serverkey<keytelnet（console，aux）Quidway(config)#aaaauthenticationlogindefaultradiusRadiusQuidway(conf