I'm configuring my first Cisco product (WS-C3560CX-12TC-S) and trying to get to grips with aaa. I'm used to *nix where the first thing you do with headless devices is enable and configure SSH access with public-key authn, using local user accounts for authz.
Given Cisco support seems absolutely useless until you give them your first born I ended up using "Express Setup" until I could telnet in, from which point I tried to work out what that did using IOS CLI.
Right now I'm trying to nail the authentication. I have the following setup for aaa, ...
Switch#show running-config aaa ! aaa authentication login default local aaa authorization exec default local aaa authorization network default local username admin privilege 15 password 0 xxxxxxxxxxxxxxxxxxxxxxxxx ! ! ! ! ! ! ! aaa new-model aaa session-id common ! !
... and I have run ...
Switch(config)#crypto key generate rsa Switch(config)#ip ssh time-out 60 Switch(config)#ip ssh authentication-retries 2
... so I can SSH fine.
Now I'm looking at
show aaa method-lists authentication to make sure I understand what I have configured and I can't make sense of
Switch#show aaa method-lists authentication authen queue=AAA_ML_AUTHEN_LOGIN name=default valid=TRUE id=0 :state=ALIVE : LOCAL authen queue=AAA_ML_AUTHEN_ENABLE authen queue=AAA_ML_AUTHEN_PPP authen queue=AAA_ML_AUTHEN_SGBP authen queue=AAA_ML_AUTHEN_ARAP authen queue=AAA_ML_AUTHEN_DOT1X name= pvt_authen_0 valid=TRUE id=56000002 :state=DEAD : SERVER_GROUP private_sg-0 authen queue=AAA_ML_AUTHEN_8021X authen queue=AAA_ML_AUTHEN_EAPOUDP authen queue=AAA_ML_AUTHEN_CONNECTEDAPPS permanent lists name= Permanent Enable None valid=TRUE id=0 :state=ALIVE : ENABLE NONE name= Permanent Enable valid=TRUE id=0 :state=ALIVE : ENABLE name= Permanent None valid=TRUE id=0 :state=ALIVE : NONE name= Permanent Local valid=TRUE id=0 :state=ALIVE : LOCAL name= Permanent rcmd valid=TRUE id=0 :state=ALIVE : RCMD
private_sg-0 have come from? Why might it have been created? I have a record of what I've done and I certainly haven't typed that in or (knowingly) chosen to configure any RADIUS servers (I don't have the need for them AFAICT).
Switch#show radius server-group all Server group radius Sharecount = 1 sg_unconfigured = FALSE Type = standard Memlocks = 1
Have I gone wrong somewhere?
And if you fancy a more comprehensive answer: how far am I of having "a single database of local users for SSH with public-key auth configured"? Any tips to achieve this config on IOS?