I'm configuring my first Cisco product (WS-C3560CX-12TC-S) and trying to get to grips with aaa. I'm used to *nix where the first thing you do with headless devices is enable and configure SSH access with public-key authn, using local user accounts for authz.
Given Cisco support seems absolutely useless until you give them your first born I ended up using "Express Setup" until I could telnet in, from which point I tried to work out what that did using IOS CLI.
Right now I'm trying to nail the authentication. I have the following setup for aaa, ...
Switch#show running-config aaa
!
aaa authentication login default local
aaa authorization exec default local
aaa authorization network default local
username admin privilege 15 password 0 xxxxxxxxxxxxxxxxxxxxxxxxx
!
!
!
!
!
!
!
aaa new-model
aaa session-id common
!
!
... and I have run ...
Switch(config)#crypto key generate rsa
Switch(config)#ip ssh time-out 60
Switch(config)#ip ssh authentication-retries 2
... so I can SSH fine.
Now I'm looking at show aaa method-lists authentication to make sure I understand what I have configured and I can't make sense of AAA_ML_AUTHEN_DOT1X.
Switch#show aaa method-lists authentication
authen queue=AAA_ML_AUTHEN_LOGIN
name=default valid=TRUE id=0 :state=ALIVE : LOCAL
authen queue=AAA_ML_AUTHEN_ENABLE
authen queue=AAA_ML_AUTHEN_PPP
authen queue=AAA_ML_AUTHEN_SGBP
authen queue=AAA_ML_AUTHEN_ARAP
authen queue=AAA_ML_AUTHEN_DOT1X
name= pvt_authen_0 valid=TRUE id=56000002 :state=DEAD : SERVER_GROUP private_sg-0
authen queue=AAA_ML_AUTHEN_8021X
authen queue=AAA_ML_AUTHEN_EAPOUDP
authen queue=AAA_ML_AUTHEN_CONNECTEDAPPS
permanent lists
name= Permanent Enable None valid=TRUE id=0 :state=ALIVE : ENABLE NONE
name= Permanent Enable valid=TRUE id=0 :state=ALIVE : ENABLE
name= Permanent None valid=TRUE id=0 :state=ALIVE : NONE
name= Permanent Local valid=TRUE id=0 :state=ALIVE : LOCAL
name= Permanent rcmd valid=TRUE id=0 :state=ALIVE : RCMD
Where might private_sg-0 have come from? Why might it have been created? I have a record of what I've done and I certainly haven't typed that in or (knowingly) chosen to configure any RADIUS servers (I don't have the need for them AFAICT).
Switch#show radius server-group all
Server group radius
Sharecount = 1 sg_unconfigured = FALSE
Type = standard Memlocks = 1
Have I gone wrong somewhere?
And if you fancy a more comprehensive answer: how far am I of having "a single database of local users for SSH with public-key auth configured"? Any tips to achieve this config on IOS?
