Removing AAA commands from 3448cl

[sdewndr]

I'm having issues removing configured aaa commands on a production 3448cl. Specifically the commands are:

aaa authentication telnet login tacacs local
aaa authentication telnet enable radius local
aaa authentication ssh login tacacs local
aaa authentication ssh enable tacacs local

Simply placing a "no" in front of them does not work. Also, disabling telnet and ssh on the switch does not help, nor does removing password protection. Any ideas other than resetting the switch?

[Jeff Carrell]

You can't remove these commands, you have to basically reset them back to original or different:

aaa authentication telnet login local
aaa authentication telnet enable local
aaa authentication ssh login local
aaa authentication ssh enable local

would reset them back to original state.


Below is the basics of the overall command 'aaa authentication':

aaa authentication



hth...Jeff

PS, I posted this reply to your question on the the HP forum :-)

[sdewndr]

Thanks, I will try this in just a bit and get back to you.

[sdewndr]

When I try that, I get "Not legal combination of authentication methods"

(config)# aaa authentication telnet login local
Not legal combination of authentication methods.

(config)# aaa authentication telnet enable local
Not legal combination of authentication methods.

(config)# aaa authentication ssh login local
Not legal combination of authentication methods.

(config)# aaa authentication ssh enable local
Not legal combination of authentication methods.

[Jeff Carrell]

sdewndr said: "When I try that, I get "Not legal combination of authentication methods"

(config)# aaa authentication telnet login local
Not legal combination of authentication methods."

hmmm...well, simply start doing "?" to see what the options are:

'aaa authentication telnet login ?'

These commands have worked for many years on many different ProCurve switches, altho it has been maybe 2+ years that I have been on a 3400/5300 (same code base basically)...

It would take me longer to find my 3400-24 and see the options...

hth...Jeff

btw, 'show authentication' shows how these are all set...

[sdewndr]

3400cl# conf t
3400cl(config)# aaa authentication login
privilege-mode Specify that switch respects the authentication server's
privilege level.
3400cl(config)# aaa authentication login privilege-mode

3400cl(config)# aaa authentication login privilege-mode

[Jeff Carrell]

From my 3500yl:

Core(config)# aaa authentication telnet
enable Configure access to the privileged mode commands.
login Configure login access to the switch.

Core(config)# aaa authentication telnet
enable Configure access to the privileged mode commands.
login Configure login access to the switch.

(config)# aaa authentication telnet login
local Use local switch user/password database.
tacacs Use TACACS+ server.
radius Use RADIUS server.
peap-mschapv2 Use RADIUS server with PEAP-MSChapv2.

try these.

[sdewndr]

I figured it out. To disable aaa authentication for the enable command you must do:

aaa authentication telnet enable local none
aaa authentication ssh enable local none

This sets it back to it's default.