Users Guide

Enable login statistics
OS10(config)# login-statistics enable
To disable login statistics, use the no login-statistics enable command.
Privilege levels
Controlling terminal access to a switch is one method of securing the device and network. To increase security, you can limit user access
to a subset of commands using privilege levels.
Configure privilege levels, add commands to them, and restrict access to the command line with passwords. The system supports 16
privilege levels:
• Level 0—Provides users the least privilege, restricting access to basic commands.
• Level 1—Provides access to a set of show commands and certain operations such as ping, traceroute, and so on.
• Level 15—Provides access to all available commands for a particular user role.
• Levels 0, 1, and 15—System configured privilege levels with a predefined command set.
• Levels 2 to 14—Not configured. You can customize these levels for different users and access rights.
Privilege levels inherit the commands supported on all lower levels. After logging in with a user role, a user has access to commands
assigned to his privilege level and lower levels.
For users assigned to the sysadmin, netadmin, and secadmin roles, you cannot configure a privilege level lower than 2. You can
configure
netoperator users with privilege levels 0 or 1.
After you assign commands to privilege levels, assign the privilege level to users with the username command. Use the enable
password privilege-level command to switch between privilege levels and access the commands supported at each level. The
disable command takes the user to a lower level.
When a remote user logs in, OS10 checks for a match in the local system. If a local user entry is found, the privilege level of the local user
is applied to the remote user for the login session. If no match is found in the local system, OS10 assigns a default privilege level according
to the role of the remote user:
• sysadmin, secadmin, and netadmin roles: Level 15
• netoperator role: Level 1
NOTE:
The role of a local user in the system and the remote user who logs in must be the same at both ends.
Configure privilege levels
To restrict CLI access, create the required privilege levels for user roles, assign commands to each level, and assign privilege levels to
users.
1. Create privilege levels in CONFIGURATION mode.
privilege mode priv-lvl privilege-level command-string
• mode — Enter the privilege mode used to access CLI modes:
• exec — Accesses EXEC mode.
• configure — Accesses class-map, DHCP, logging, monitor, openflow, policy-map, QOS, support-assist, telemetry, CoS,
Tmap, UFD, VLT, VN, VRF, WRED, and alias modes.
• interface — Accesses Ethernet, fibre-channel, loopback, management, null, port-group, lag, breakout, range, port-channel,
and VLAN modes.
• route-map — Accesses route-map mode.
• router — Accesses router-bgp and router-ospf modes.
• line — Accesses line-vty mode.
• priv-lvl privilege-level — Enter the number of a privilege level, from 2 to 14.
• command-string — Enter the commands supported at the privilege level.
2. Create a user name, password, and role, and assign a privilege level in CONFIGURATION mode.
username username password password role role priv-lvl privilege-level
• username username — Enter a text string; 32 alphanumeric characters maximum; one character minimum.
• password password — Enter a text string; 32 alphanumeric characters maximum, nine characters minimum.
934
Security