How to create a command line interface (CLI) SysAdmin user, and use that CLI User to execute commands on the TPAM appliance. (4218855)

Before beginning:

- Once a SysAdmin has been granted Web access, Web access cannot be removed for this user.
- A new user may be generated with *only* CLI access, and other SysAdmin users may generate and download keys for this new user.
- Enabling Web access for a SysAdmin user will reset any existing authentication keys

This example requires some free tools from putty.org (putty.exe, puttygen.exe, plink.exe, pscp.exe). They can be dowloaded from http://www.putty.org under the 'putty' section:

To create CLI SysAdmin user in 2.5:

1. Sign into the '/admin' GUI of the applicance using an existing SysAdmin (eg; 'parmaster')
2. Click 'Sys-Admin UserIDs | Manage Sys-Admin UserIDs' tab.
3. Click 'Add User' button at the bottom of the page.
4. Create a Web Password for this user, then on the 'Key-Based' tab for the user, ensure 'CLI' is also checked. For this example, a Web and CLI SysAdmin will be created. The currently signed in user will not be able to generate or download a key - the user must generate and download their own CLI keys.
5. Sign out of the '/admin' interface.  Close the browser, then open the browser and sign in to the /admin interface again as the new Web/CLI user just created.
6. At the top right of the screen, the currently signed-in username is listed.  Click on the username to open the user menu and then click 'User Details'.
7. Click the 'Reset SysAdmin CLI Key' button to generate a new (or reset an existing) CLI key.
8. Click 'Get SysAdmin Cli Key' button to download the CLI key.

At this point the id_dsa file can be downloaded and used via native SSH. The CLI account can be tested with a command such as GetStatus:

ssh -i id_dsa cliadmin@192.168.0.1 GetStatus -u

NOTE: The case of the user should match the UserID in TPAM. 

To use the key in Putty / Plink

1. In order to use the key with Plink it must be converted to a PPK file.
2. Run puttygen, click the 'Load' button and select the key just downloaded (note: select 'All Files' at bottom right of puttygen to view all extensions).
3. In puttygen, click 'Save Private Key'. This will generate a warning about saving without a passphrase - click 'Yes' to save the PPK file without a passphrase.

Sending CLI commands to the appliance:

The plink or pscp commands (also from putty.org) may now be used with the newly created PPK  to access the CLI commands.

The first time plink or pscp are run, they will return a warning that the host key will be imported into the registry, this is expected -- just press 'y' to 'store key in cache'.

The syntax of plink is:

plink -i [keyfile] [userid]@[PAR-address] [command] [filename]

A good test that the user is created correctly the PPK is valid would be to get the uptime of the appliance:

plink -i cliadmin.ppk cliadmin@192.168.0.1  GetStatus -u


How to create a CLI-only user (without Web access to the appliance):

The above example creates a Web and CLI enabled SysAdmin - to create a 'CLI only' user, ensure 'Allow Web Access' is not checked when creating the user(step 3), and then generate and download the keys (steps 4-5 above) as the user currently signed in to  '/admin' interaface.