Cisco Unity Express VoiceMail and Auto Attendant CLI Administrator Guide

Specifying AAA Accounting Settings

SUMMARY STEPS

1. config t

2. aaa accounting server remote

3. address address [ port port] secret secret

4. address address [ port port] credentials hidden cred

5. retries number

6. timeout seconds

7. end

8. show aaa accounting service

DETAILED STEPS

Examples

The following is sample output from the show aaa accounting service command:

Specifying AAA Authentication Settings

SUMMARY STEPS

1. config t

2. aaa authentication server remote

3. address address [ port port] secret secret

4. address address [ port port] credentials hidden cred

5. retries number

6. timeout seconds

7. end

DETAILED STEPS

Authentication Failover

The authentication failover feature enables you to optionally use a remote RADIUS server for user login authentication in addition to the local database. The procedure in this section configures the order in which authentication is resolved. You can configure authentication to use:

• Only the local database
• Only the remote server
• The local database first, then the remote server
• The remote server first, then the local database

When using both local and remote authentication, you can also configure whether you want the user attributes that are retrieved from a remote RADIUS AAA server to be merged with the attributes found in the local user database for the same username.

Note The authentication failover feature has the following limitations:

• Authentication with a RADIUS server is available only when accessing the GUI or CLI interface and requires only a user ID and password. Authentication for the TUI, VVE, AvT, and IMAP interfaces can use only the local database. Therefore, users of the TUI, VVE, AvT, and IMAP interfaces must be configured locally in order to gain access. The auto-attendant interface does not require authentication because it is user independent.
• Login information is not synchronized between the local system and the remote server. Any security features such, as password expiration, must be configured separately for Cisco Unity Express and the RADIUS server. Also, Cisco Unity Express users are not prompted when security events, such as password expiration or account lockout, occur on the RADIUS server, and vis versa.

Unreachable Failover

The unreachable failover is used only with RADIUS servers. This feature enables you to configure up to two addresses that can be used to access RADIUS servers.

As Cisco Unity Express attempts to authenticate a user with the RADIUS servers, messages are sent to users to notify them when a RADIUS server:

• Cannot be reached
• Fails to authenticate the user

Example

In this example, authentication is performed by the remote server first, then by the local database. Also, two addresses are configured for the remote RADIUS server.

This is a sequence of events that could occur during authentication for this example:

1. Cisco Unity Express tries to contact the first remote RADIUS server.

2. If the first RADIUS server does not respond or does not accept the authentication credentials of the user, Cisco Unity Express tries to contact the second remote RADIUS server.

3. If the second RADIUS server does not respond or does not accept the authentication credentials of the user, the user receives the appropriate error message and Cisco Unity Express tries to contact the local database.

4. If the local database does not accept the authentication credentials of the user, the user receives an error message.

Specifying the Policy that Controls the Behavior of Authentication and Authorization

SUMMARY STEPS

1. config t

2. aaa policy system

3. authentication-order {remote [local] | local [remote]}

4. authorization merge-attributes

5. end

6. show aaa policy

DETAILED STEPS

Examples

The following is sample output from the show aaa policy command:

Configuration Example

In this example, a company wants a security structure with two levels of security administration. The two levels allow the following actions to be taken by the administrator:

• The first level enables the security administrator to reset the passwords and PINs for users that have locked themselves out of the system, whether they forgot their password or their account is locked because of too many failed login attempts. This level will be called PASSWORD RESET.
• The second level enables the security administrator to act as a system guardian by:

– Ensuring that the proper security policies are implemented for issues such as password aging, account lockout, encryption, authentication, authorization, and accounting

– Ensuring that voicemail messages and other data remain safe from attackers without over burdening end users with security related details and tasks

– Monitoring the system to ensure that only legitimate users have access

– Troubleshooting any problems that legitimate users have with accessing the system

– Resetting passwords and PINs for users that have locked themselves out of the system, whether they forgot their password or their account is locked because of too many failed login attempts

This level will be called SYSTEM GUARDIAN

When you use the general planning and configuration steps as described in the “Configuring Privileges” section, to set up the security administration levels for this example, these are the results:

• You have already decided:

– How many levels or categories of user privileges you want to create for your company

– Which functions each privilege will allow your users to perform

There will be two levels, called PASSWORD RESET and SYSTEM GUARDIAN, as described above.

• After reviewing the predefined privileges to determine whether any of them are similar to the permissions that you want to give each of your security levels, you find that:

– The predefined privilege called manage-passwords can be used for the security level named PASSWORD RESET because it has all of the permissions needed to help users that have locked themselves out of the system.

– The manage-passwords privilege also has a subset of the permissions needed the security level named SYSTEM GUARDIAN and is the predefined privilege closest to your requirements. However, to act as system guardian, the following additional operations will have to included: security.access, security.aaa, security.password, security.pin, system.debu g, and system.view. See Table 9-2 for more information.

• Use the following commands to configure a privilege for the SYSTEM GUARDIAN security level by including the predefined privilege manage-password and adding the operations listed in the previous bullet:

Note You do not have to configure a privilege for the PASSWORD RESET security level because you can use the predefined privilege manage-passwords.

• Use the following commands to create a new group called password-reset and assign the privilege called manage-password s to it:

• Use the following commands to create a new group called system-guardian and assign the privilege called guardian-privilege :

• Assign the appropriate users to the new groups, associating them with their roles. For example, if you want Bob and Ned to have the privileges of the PASSWORD RESET security administration level and Ann to have the privileges of the SYSTEM GUARDIAN security administration level, use the following commands:

• The configuration of this example is now complete. You can verify your configuration using the following commands.

The following is sample output from the show group detail groupname password-reset expanded command:

The following is sample output from the show group detail groupname system-guardian expanded command:

The following is sample output from the show privilege detail manage-passwords expanded command:

The following is sample output from the show privilege detail guardian-privilege expanded command:

Creating and Customizing Privileges

SUMMARY STEP

1. config t

2. privilege privilege-name create

3. privilege privilege-name description string

4. privilege privilege-name operation operation-name

5. privilege privilege-name member privilege-name2

6. end

7. show operations

8. show operation detail operation-name

9. show privileges

10. show privilege detail privilege-name

DETAILED STEPS

Examples

The following is sample output from the show operations command:

The following is sample output from the show operation detail command:

The following is sample output from the show privileges command:

The following is sample output from the show privilege detail command:

Configuring Accounting Event Logging

SUMMARY STEPS

1. config t

2. aaa accounting enable

3. aaa accounting event

4. login

5. logout

6. login-fail

7. config-commands

8. exec-commands

9. system-startup

10. system-shutdown

11. end

12. show aaa accounting event

DETAILED STEPS

Examples

The following is sample output from the show aaa accounting event command:

Specifying Whether the Console Connection is Subject to Authentication

SUMMARY STEPS

1. config t

2. line console

3. login

4. end

DETAILED STEPS