HPE Aruba 2530 Switch - Local Users and Groups

[Jeff2262]

Hi there, hello.

I need to add a new local user (‘support’) to a bunch of HPE/Aruba switches.

I’ve got this command so far:

aaa authentication local-user Support group

…but at that stage I need to specify the group. How do I list the available groups?

Documentation I’ve found so far suggests this:

show user-group

…but that just results in

Invalid input: user-group

You might be asking “What sort of local user?”, and that’s a reasonable question!

Originally I was told that it’s required to use with some software called Nornir to run various show commands in order to query the configs and ARP tables on our switches, so I would have said a ‘read-only’ user will do (is that better known as an “operator”?)

However, I’ve since been told that Nornir needs to “…enter the enabled mode” in order to be able to run commands such as Display current-configuration and Screen-length disable(again, is that better known as a ‘manager’ level account?)

Either way I believe the way to do this is to assign the new local user to the right group, but I’m struggling to find what those groups are!

In case it helps, here’s the show version output from the device I’m trying this out on:

switch6(config)# show version

Image stamp:    /ws/swbuildm/rel_beluru_qaoff/code/build/lakes(swbuildm_rel_beluru_qaoff_rel_beluru)
                Jul 11 2024 22:15:38
                YA.16.11.0020
                669
Boot Image:     Primary

Boot ROM Version:    YA.15.20

[phildrew]

With Aruba switches, you can type ? after a command to see what other options it has.

So, if you don’t know the command to show what you’re looking for, type “show ?” and hit Enter. The CLI will list all the valid next words/commands.

So, I started with:
show ?

From there, I thought that authentication or authorization would be good next places to check.
show authentication ?
show authorization ?

The second one shows a group option, so let’s try that:
show authorization group

This shows the security groups defined in the switch.

[Jeff2262]

@phildrew

The second one shows a group option, so let’s try that:
show authorization group

This shows the security groups defined in the switch.

Thanks yes, I had come across that, but the results don’t make sense to me:

# show authorization group

 Local Management Groups - Authorization Information


  Group Name            : default-security-group
  Group Privilege Level : 19

  Users
  ----------------

  Seq. Num.  | Permission URI String      Json String     URI Access URI Log
  ---------- + ---------- --------------- --------------- ---------- -------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  1          | Permit     security-log                               Disable

Which seems to just shows me details of the current account’s group, rather than all the available groups. Or am I misreading it?

[phildrew]

Your output lists a Group Name. That is the group that exists on your switch…

What other groups have you configured that you cannot find?

Let’s examine the commands again.
aaa authentication local-user <Username> group ?

This says you need to substitute a group name where I have the question mark

Now
show authorization group ?

Looks familiar, it’s asking for the same substitution, so that’s where to find the group it’s looking for to complete the command.

[Jeff2262]

@phildrew

What other groups have you configured that you cannot find?

Not 100% sure, but I think what’s not helping here is that the switch must have been rebooted without a wri mem, because I’m sure another local account had been created with a ‘read only’ group to add it to.

But okay, here we are. How then do I establish what permissions the default-security-group (aka the Level-19 group?) grants?

[phildrew]

@Jeff2262

the results don’t make sense to me:

Is that literally all you see when running the command show authorization group?

There’s no other lines of output that you omitted?

[Jeff2262]

@phildrew

Is that literally all you see when running the command show authorization group?

switch6(config)# show authorization group

 Local Management Groups - Authorization Information


  Group Name            : default-security-group
  Group Privilege Level : 19

  Users
  ----------------

  Seq. Num.  | Permission URI String      Json String     URI Access URI Log
  ---------- + ---------- --------------- --------------- ---------- -------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  1          | Permit     security-log                               Disable

switch6(config)#

[phildrew]

https://arubanetworking.hpe.com/techdocs/AOS-Switch/16.11/Aruba%202930MF%20Access%20Security%20Guide%20for%20AOS-S%2016.11.pdf

You need to read the RBAC section of the documentation. You’ll also note that the documentation mentions the named default roles: operator, manager, and default-security-group (last one looks familiar!).

From what you’ve described, it sounds like you just need to create an user account with the operator role. password operator user-name <username> plaintext <password>

You may want to consider doing a factory reset on your switch. I would expect to see the predefined roles for level 0-15 when outputting the groups.

You could also create a custom group, and allow/deny the specific commands you want it to have. For example, on my switch, the predefined “Level-1” role/group exists (equivalent to “operator”).

You can see the ordered permission list, and what commands that users with the role are allowed (and not allowed) to run.

[Jeff2262]

Well, good grief! We have over 20 switches in use around the building and I go and pick the one that’s “special”!

If I run the same command on another switch, I get something that I suspect is more like what you were expecting to see:

switch6b#
switch6b# show authorization group

 Local Management Groups - Authorization Information


  Group Name            : default-security-group
  Group Privilege Level : 19

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  1          | Permit     security-log                               Disable

  Group Name            : Level-0
  Group Privilege Level : 20

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Permit     command:ping *                             Disable
  1000       | Permit     command:ping6 *                            Disable
  1001       | Permit     command:traceroute *                       Disable
  1002       | Permit     command:traceroute6 *                      Disable
  1003       | Permit     command:ssh *                              Disable
  1004       | Permit     command:telnet *                           Disable
  1005       | Deny       .*                                         Disable

  Group Name            : Level-1
  Group Privilege Level : 21

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Permit     command:ping *                             Disable
  1000       | Permit     command:ping6 *                            Disable
  1001       | Permit     command:traceroute *                       Disable
  1002       | Permit     command:traceroute6 *                      Disable
  1003       | Permit     command:ssh *                              Disable
  1004       | Permit     command:telnet *                           Disable
  1005       | Deny       command:show history *                     Disable
  1006       | Deny       command:display history-command *          Disable
  1007       | Permit     command:show *                             Disable
  1008       | Permit     command:display *                          Disable
  1009       | Deny       .*                                         Disable

  Group Name            : Level-2
  Group Privilege Level : 22

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Deny       .*                                         Disable

  Group Name            : Level-3
  Group Privilege Level : 23

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Deny       .*                                         Disable

  Group Name            : Level-4
  Group Privilege Level : 24

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Deny       .*                                         Disable

  Group Name            : Level-5
  Group Privilege Level : 25

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Deny       .*                                         Disable

  Group Name            : Level-6
  Group Privilege Level : 26

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Deny       .*                                         Disable

  Group Name            : Level-7
  Group Privilege Level : 27

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Deny       .*                                         Disable

  Group Name            : Level-8
  Group Privilege Level : 28

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Deny       .*                                         Disable

  Group Name            : Level-9
  Group Privilege Level : 29

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Deny       command:configure aaa *                    Disable
  1000       | Deny       command:configure password *               Disable
  1001       | Deny       command:configure tacacs-server *          Disable
  1002       | Deny       command:configure radius-server *          Disable
  1003       | Deny       command:configure front-panel-security *   Disable
  1004       | Permit     .*                                         Disable

  Group Name            : Level-10
  Group Privilege Level : 30

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Deny       .*                                         Disable

  Group Name            : Level-11
  Group Privilege Level : 31

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Deny       .*                                         Disable

  Group Name            : Level-12
  Group Privilege Level : 32

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Deny       .*                                         Disable

  Group Name            : Level-13
  Group Privilege Level : 33

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Deny       .*                                         Disable

  Group Name            : Level-14
  Group Privilege Level : 34

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Deny       .*                                         Disable

  Group Name            : Level-15
  Group Privilege Level : 35

  Users
  ----------------

  Seq. Num.  | Permission Rule Expression                            Log
  ---------- + ---------- ------------------------------------------ -------
  999        | Permit     command:configure .*                       Disable
  1000       | Permit     .*                                         Disable

switch6b#

[Jeff2262]

@phildrew

You could also create a custom group

Yes, I think I’d gathered that this was a possibility, and it’s one I like for this particular usage reason*.

*It’s for a third-party company who document our environment and produce vector-graphic images in PDFs, so you can zoom in with no loss of clarity and get an understanding of how the environment works.

[phildrew]

Yep, that’s what you should see! And why I recommend a factory reset - unless there’s a documented reason that switch is different.

So reference the PDF document (or find a more updated one on Aruba support, what I linked should do - the commands for this shouldn’t haven’t changed that much, if at all), and use one of your unassigned groups (any of the ones that only have a deny permission) to create a command permissions list for what you need this account to do (don’t forget the blanket deny-all at the end).

You’ll have to do that for every switch that the monitoring account needs to log into, but after the first one, it’s a simple copy/paste of the config.

[Jeff2262]

@phildrew

unless there’s a documented reason that switch is different

Well, it’s the one switch that’s not in a locked area (it’s in a small unlocked cabinet in a meeting room). That’s the only reason I can think of why it would be different, but I’ve not found any documentation on it.

@phildrew

use one of your unassigned groups … to create a command permissions list for what you need this account to do

Doing/done that already.

What I’m currently puzzled about is how to add a new local account for this. Some documentation I’ve seen suggests the aaa authorization command should have an option like local-user but all I see is this:

switch21# config
switch21(config)# aaa authorization
 commands              Configure command authorization.
 group                 Create or remove an authorization rule.
 rest-uri              Configure rest-uri authorization.
 user-role             Configure user roles.
switch21(config)#
switch21(config)#

‘user-role’ does not sound seem to be the same thing.

@phildrew

You’ll have to do that for every switch that the monitoring account needs to log into

Indeed, but is there not some solution out there that can do this as a global change to all switches? Actually our supplier has suggested that Nornir that can do it, but that looks very Linux-y which is not our bag!

[spiceuser-kf9w]

yes. its a great thought

[Jeff2262]

I believe that I have discovered the issue is that these switches can only have two accounts. An ‘operator’, and a ‘manager’. We can name them whatever we want, but we can’t add to them (i.e. we can’t have three or more accounts, just the two built-in accounts).

My guess from that is that HP/Aruba are expecting RADIUS to be used for any authentication beyond these two accounts.

[Jeff2262]

It’s amazing what you can do when you use the correct (albeit very similarly spelt) parameter:

switch# aaa authentication local-user documentation_user group doc_group password plaintext

Note ‘authentication’, NOT ‘authorization’.

[phildrew]

DOH!!

That’s what you had written in your first post. You just didn’t know how to find and specify the group you wanted to add the user to.

Since that switch is accessible to the public, that’s the likely explanation for the default config being removed/modified - to harden the config to only what is necessary, and reduce risk if someone manages to plug in a console cable