Users Guide

OS10(config)# show running-configuration users
username admin password $6$q9QBeYjZ$jfxzVqGhkxX3smxJSH9DDz7/3OJc6m5wjF8nnLD7/
VKx8SloIhp4NoGZs0I/UNwh8WVuxwfd9q4pWIgNs5BKH role sysadmin priv-lvl 15
username test1 password $6$rounds=656000$50vutEWA9w3ImvF.$2pSDnaINYTKCQ6WAlJqeabiFQNRvUgui3.
6vR2e.L/D7DBwnV0QtY.KtOBTZAIDDT5.AFWxQHVgs2/V3jC3yG1 role sysadmin priv-lvl 15
OS10(config)# show running-configuration radius-server
radius-server host 10.2.2.2 key 9
3c0e479bd43bb5baf4ebb16e1317a845f01f832e25a03836c70bd26b9754d6a0
OS10(config)# show running-configuration tacacs-server
tacacs-server host 10.1.1.1 auth-port 7777 key 9
27ca79bf3cbf351708c8d19caf50815661dcd0638719a06c865e88090d03558b
Role-based access control
RBAC provides control for access and authorization. Users are granted permissions based on defined roles — not on their individual
system user ID. Create user roles based on job functions to help users perform their associated job functions. You can assign each user
only a single role, and many users can have the same role. A user role authenticates and authorizes a user at login, and places the user in
EXEC mode. For more information, see CLI basics.
OS10 supports four pre-defined roles: sysadmin, secadmin, netadmin, and netoperator. Each user role assigns permissions that
determine the commands a user can enter, and the actions a user can perform. RBAC provides an easy and efficient way to administer
user rights. If a user’s role matches one of the allowed user roles for a command, command authorization is granted.
The OS10 RBAC model provides separation of duty and greater security. It places limitations on each role’s permissions to allow you to
partition tasks. For greater security, only some user roles can view events, audits, and security system logs.
Assign user role
To limit OS10 system access, assign a role when you configure each user.
• Enter a user name, password, and role in CONFIGURATION mode.
username username password password role role
• username username — Enter a text string. A maximum of 32 alphanumeric characters; 1 character minimum.
• password password — Enter a text string. A maximum of 32 alphanumeric characters; 9 characters minimum.
• role role — Enter a user role:
• sysadmin — Full access to all commands in the system, exclusive access to commands that manipulate the file system, and
access to the system shell. A system administrator can create user IDs and user roles.
• secadmin — Full access to configuration commands that set security policy and system access, such as password strength,
AAA authorization, and cryptographic keys. A security administrator can display security information, such as cryptographic
keys, login statistics, and log information.
• netadmin — Full access to configuration commands that manage traffic flowing through the switch, such as routes,
interfaces, and ACLs. A network administrator cannot access configuration commands for security features or view security
information.
• netoperator — Access to EXEC mode to view the current configuration. A network operator cannot modify configuration
settings on a switch.
Create user and assign role
OS10(config)# username smith password silver403! role sysadmin
View users
OS10# show users
Index Line User Role Application Idle Login-Time Location
----- ---- ------ ------ ----------- ---- --------------------- -------------
1 ttyS root root -bash >24h 2018-05-23 T23:05:03Z console
2 pts/0 admin sysadmin bash 1.1s 2018-05-30 T20:04:27Z 10.14.1.214[ssh]
924
Security