S1720, S2700, S5700, and S6720 V200R011C10 Configuration Guide - Basic Configuration
This document describes methods to use command line interface and to log in to the device, file operations, and system startup configurations.
This document describes methods to use command line interface and to log in to the device, file operations, and system startup configurations.
Configuring an Authentication Mode for a VTY User Interface
Context
The system provides three authentication modes for a VTY user interface: AAA authentication, password authentication, and none authentication.
AAA authentication: Users must enter both user names and passwords for login. If either a user name or a password is incorrect, the login fails.
Password authentication: Users must enter passwords for login. Only after a user enters the correct password does the device allow the user to log in.
None authentication: Users can directly log in without entering any information.
![]()
If non-authentication is used, any user can be successfully authenticated without the need of entering the user name and password. Therefore, you are not advised to use non-authentication for device or network security purposes.
Regardless of the authentication mode, the system starts the delayed login mechanism in the case of a device login failure. If the first login fails, the user can log in again 5 seconds later. The delay time is increased by 5 seconds every time a login failure occurs. The second login is delayed to 10 seconds, and the third login is delayed to 15 seconds.
Procedure
- Configure AAA authentication.
- Configure password authentication.
- Run set authentication password [ cipher password ]
An authentication password is set.
If you do not specify cipher password, you can enter a password in plain text in interactive mode. The password entered in interactive mode is not displayed on the screen. If you specify cipher password, you can enter a plain text password or cipher text password. Both types of passwords are saved to the configuration file in cipher text. Passwords in plain text have potential security risks. It is recommended that you enter a password in interactive mode.
By default, the system checks the complexity of the entered password. The password takes effect only if it meets the complexity requirement. To disable the password complexity check function, run the user-interface password complexity-check disable command. However, keeping the password complexity check function enabled is recommended, which improves system security.
![]()
By default, the minimum length of passwords in plain text allowed by a device is 8 characters. You can set a longer password to increase password complexity and improve device security. Run the set password min-length length command to set the minimum length of passwords in plain text allowed by the device.
- Run set authentication password [ cipher password ]
- Configure none authentication.
