topic Re: Limit SSH access to certain users on specific switches via ExtremeControl in ExtremeControl

Limit SSH access to certain users on specific switches via ExtremeControl

Stephen_Stormon — Wed, 16 Nov 2022 18:17:45 GMT

We currently have a rule in Extreme Control that allows SSH access to members of an Active Directory group and another rule that prevents SSH access from anyone else. What I am now trying to do is create a third rule that will let Active Directory accounts of two users SSH to two specific switches (and only those two switches). Is that possible?

Re: Limit SSH access to certain users on specific switches via ExtremeControl

Robert_Haynes — Thu, 17 Nov 2022 13:35:29 GMT

This should be possible. A rule with a Location group and the Location group specifying the two specific switches by IP... as well as perhaps a User Group -> LDAP User Group style lookup to either match on a memberOf group specific to those two users only.. or you can actually do a sAMAccountName=<user1> or sAMAccountName=<user2> attribute matching ANY to accomplish the same goal. The rest of the users would fall through to your SSH block rule.

Re: Limit SSH access to certain users on specific switches via ExtremeControl

Stephen_Stormon — Wed, 23 Nov 2022 19:05:46 GMT

I do have the user group with match any with sAMAccountName for both users. I was trying to use a End-System Group to limit access to switches but it seems to work when I changed it to Location group instead. Thanks!