fir3net
PPS-Firenetbanner-780.5x190-30-03-17

F5 - Unable to Create Local Account with Remote Auth

Issue

When remote authentication is configured it is not possible (out of the box) to configure local user accounts. Other then the default admin and root accounts provided.

This is also stated within the TMOS Management Guide for BIG-IP Systems, which says: "Excluding the admin account, the entire set of standard user accounts that you create for BIG-IP system administrators must reside either locally on the BIG-IP system, or remotely on another type of authentication server."

Solution

In order to configure an additional local account when remote authentication is enabled a few extra commands are required. These are shown below,

First the account is configured within TMSH,

create auth user USERNAME role <admin/manager/operator/guest> shell <tmsh/none> partition-access all prompt-for-password

Next we configure the account to use local authentication.

run util bash
echo "USERNAME" >> /config/bigip/auth/localusers sed -ri 's/(localonlyusers LT_STRING_LIST.*)"/\1 \{USERNAME\}"/' /etc/confpp.dat

Tags: BIG-IP F5

About the Author

RDonato

R Donato

Rick Donato is the Founder and Chief Editor of Fir3net.com. He currently works as a Principal Network Security Engineer and has a keen interest in automation and the cloud.

You can find Rick on Twitter @f3lix001