TACACS+ Authentication Manager Help >> Operation Guide >> Device User >> Denylist User Management

Denylist User Management

Use the denylist user management function to block a device user under the following conditions:

• Locked by Operator: Through user log analysis, an operator can identify users who pose security threats to the network, and then add them to the denylist. The blocked user cannot manage devices. Only the operator can un-denylist a user who has been blocked. The user cannot be un-denylist automatically.
• Malicious Login Attempt: If the number of unsuccessful password attempts exceeds the limit, TAM assumes that an illegal user is trying to gain access to the network and adds that user to the denylist. The maximum password retries allowed is decided by the Max. Authentication Attempts in the system parameters.

Features

• Query Denylist Users
  
  Perform this task to query denylist device users by predefined query criteria.

  Procedure

  1. Click the User tab, and then select Device User > Denylist Users from the navigation tree.
  2. The Query Denylist Users function provides the basic query and advanced query. You can switch between basic query and advanced query by clicking the Basic Query link and the Advanced Query link in the right upper corner. Basic query criteria include account name, device user group, and reason for denylist. Advanced query criteria include account name, device user group, reason for denylist, denylist time, and user IP address. Account name supports fuzzy query.
  3. Click Query to display the denylist users matching the query criteria, or click Reset to query denylist users with the default query criteria.
• Denylist/Undenylist Users
  
  On the detailed device user information page, you can add the user to the denylist or remove the user from the denylist.

  Procedure

  To add a device user to the denylist:
  
  1. On any page related to device user functions, you can click the account name of a device user to open the device user details page.
  2. If the device user is not in denylist, you can click the Add to Denylist link to add the device user to the denylist.
  To remove a device user from the denylist:
  
  1. On any page related to device user functions, you can click the account name of a device user to open the device user details page.
  2. If the user is marked as denylist, you can click the Remove from Denylist link to remove the device from the denylist.
• Add to Denylist
  
  Perform this task to add one or more device users to the denylist. Users in denylist cannot manage devices.

  Procedure

  1. Click the User tab, and then select Device User > All Device Users from the navigation tree.
  2. Select one or more device users from the device user list. and then click Add to Denylist.
     A confirmation dialog box appears.
  3. Click OK.
• Remove from Denylist
  
  Perform this task to manually remove device users from the denylist. Un-denylist users can log in and manage devices.

  Procedure

  1. Click the User tab, and then select Device User > Denylist Users from the navigation tree.
  2. Select one or more blocked users, and then click Un-denylist.
     A confirmation dialog box appears.
  3. Click OK.