Hi F5'ers, I'd like to provision (some) local users even though Remote Authentication (using Radius) is provisioned. F5 removed f5adduser (in 10.1.0), so, what's the sanctioned alternative? R's, Alex.

Hi Willy,Enable "Fallback to Local" (System » Users » Authentication)Create a user (System » Users » User List)Run the below command:echo "username" >> /config/bigip/auth/localusers sed -ri 's/(localonlyusers LT_STRING_LIST.*)"/\1 \\{username\\}"/' /etc/confpp.dat

tmsh create /auth user role shell partition-access encrypted-password|password|prompt-for-password

"TMOS Management Guide for BIG-IP Systems" says: "Excluding the admin account, the entire set of standard user accounts that you create for BIG-IP system administrators must reside either locally on the BIG-IP system, or remotely on another type of authentication server." So, answer is - it can't be done.

I am a bit confused now,in the top rectangle it is mentioned "can't be done".The next rectangle provides a command for doing it ?At this moment we are using version 12.1.3.7. Is there any change ?We would like to use one extra local user on top of the remote users , to run a script for automated backup with keys.Point is that we would like to take the server the initiative for the actions.Anyone a suggestion ?

Hello, I have been looking for the Fallback to Local, in the above screen : Is it possible that this option is not available in 12.1.3.7 ?

Creating local users when using Remote Authentication

Sam_Novak
Altostratus
Nov 02, 2022
/etc/cron.hourly/localUserInsert
#!/bin/bash grep myUser /config/bigip/auth/localusers if [ $? -eq 1 ]; then echo myUser >> /config/bigip/auth/localusers fi
And i'll probably need to recreate it after every upgrade, but that's not a big deal.
Willy
Nimbostratus
Nov 20, 2019
Thank you jaikumar_f5 and Dojs for your advice and effort. I will go for the update to a version above 12, it is than a standard feature.
Dojs
Cirrostratus
Nov 18, 2019
Remove the Radius Authentication, create the users and config it again.
Willy
Nimbostratus
Nov 18, 2019
Hello eaa,

Tried to modify the database parameter, and succeeded, but stil not able to create a local user. When I tried to create a user via cli, and then change the password, I still get the answer "Please change the password at the remote authentication server". Also in the GUI there is no extra trace of a field that suggest a local user fallback. Maybe it is easier to plan a migration to version 13.
- jaikumar_f5
  MVP
  Nov 18, 2019
  There is no fallback authentication.
Willy
Nimbostratus
Nov 14, 2019
Hello,

I have been looking for the Fallback to Local, in the above screen :

Is it possible that this option is not available in 12.1.3.7 ?
- Enes_Afsin_Al
  MVP
  Nov 15, 2019
  Available from v13.
  Can you try this command?
  modify /sys db systemauth.fallback.remotetolocal value true
  I think, it is not possible in TACACS+ authentication on v12.1.x.
  REF: https://support.f5.com/csp/article/K03546096
Willy
Nimbostratus
Nov 13, 2019
I am a bit confused now,in the top rectangle it is mentioned "can't be done".
The next rectangle provides a command for doing it ?
At this moment we are using version 12.1.3.7. Is there any change ?
We would like to use one extra local user on top of the remote users , to run a script for automated backup with keys.
Point is that we would like to take the server the initiative for the actions.
Anyone a suggestion ?
- Enes_Afsin_Al
  MVP
  Nov 14, 2019
  Hi Willy,
  Enable "Fallback to Local" (System » Users » Authentication)
  Create a user (System » Users » User List)
  Run the below command:
  echo "username" >> /config/bigip/auth/localusers sed -ri 's/(localonlyusers LT_STRING_LIST.*)"/\1 \\{username\\}"/' /etc/confpp.dat
  - jaikumar_f5
    MVP
    Apr 30, 2021
    
    That is the behavior of the box. Please refer the article K11333640.
    To overcome this, you'll have to create a startup script. Which would be on /config/startup.
    
    Did you put the entries there & yet you see this issue ?
    Also note this is pretty 10 year old thread, please open a new thread so it could be addressed properly.
epaalx
Cirrus
Sep 05, 2011
"TMOS Management Guide for BIG-IP Systems" says: "Excluding the admin account, the entire set of standard user accounts that you create for BIG-IP system administrators must reside either locally on the BIG-IP system, or remotely on another type of authentication server."

So, answer is - it can't be done.
JRahm
Admin
Aug 22, 2011
tmsh create /auth user role shell partition-access encrypted-password|password|prompt-for-password