Users Guide

NOTE: Entering the command when an SSH key file is not present has no effect and results in a
silent failure. SSH password-less login is not enabled.
Supported on the MX9116n and MX5108n switches in Full Switch mode starting in release 10.4.1.0. Also supported
in SmartFabric mode starting in release 10.5.0.1.
The no version of the command removes the SSH password-less configuration for the specified user name.
Example
OS10(config)# username user10 sshkey filename /test_file.txt
OS10(config)# do show running-configuration users
username admin password $6$q9QBeYjZ$jfxzVqGhkxX3smxJSH9DDz7/3OJc6m5wjF8nnLD
7/VKx8SloIhp4NoGZs0I/UNwh8WVuxwfd9q4pWIgNs5BKH. role sysadmin
username user10 password $6$rounds=656000$G10VRFTJB291ekwo$iTGf0zd4bTUcBBpI
Vsbr6oStnUZMydN5lDs4WE6G3XHEtWbcKrGTeAo1wEF0cenEgRRPzi3SMmYyzAHCCC8wS0 role
sysadmin
username user10 sshkey filename /test_file.txt
Supported
Releases
10.4.1.0 or later
userrole inherit
Reconfigures the default netoperator role and permissions that OS10 assigns by default to a RADIUS or TACACS+-authenticated user
with an unknown user role or privilege level. You can also configure an unknown RADIUS or TACACS+ user role to inherit permissions from
an existing OS10 role.
Syntax
userrole {default | name} inherit existing-role-name
Parameters
• default inherit — Reconfigure the default permissions assigned to an authenticated user with a missing
or unknown role or privilege level.
• name inherit — Enter the name of the RADIUS or TACACS+ user role that inherits permissions from an
OS10 user role; 32 characters maximum.
• existing-role-name — Assign the permissions associated with an OS10 user role:
• sysadmin — Full access to all commands in the system, exclusive access to commands that manipulate
the file system, and access to the system shell. A system administrator can create user IDs and user roles.
• secadmin — Full access to configuration commands that set security policy and system access, such as
password strength, AAA authorization, and cryptographic keys. A security administrator can display
security information, such as cryptographic keys, login statistics, and log information.
• netadmin — Full access to configuration commands that manage traffic flowing through the switch,
such as routes, interfaces, and ACLs. A network administrator cannot access configuration commands for
security features or view security information.
• netoperator — Access only to EXEC mode to view the current configuration. A network operator
cannot modify any configuration setting on a switch.
Default OS10 assigns the netoperator role to a user authenticated by a RADIUS or TACACS+ server with a missing or
unknown role or privilege level.
Command Mode CONFIGURATION
Usage Information
When a RADIUS or TACACS+ server authenticates a user and does not return a role or privilege level, or returns
an unknown role or privilege level, OS10 assigns the netoperator role to the user by default. Use this command
to reconfigure the default netoperator permissions.
To assign OS10 user role permissions to an unknown user role, enter the RADIUS or TACACS+ name with the
inherit existing-role-name value. The no version of the command resets the role to netoperator.
Supported on the MX9116n and MX5108n switches in Full Switch mode starting in release 10.4.0E(R3S). Also
supported in SmartFabric mode starting in release 10.5.0.1.
Example
OS10(config)# userrole default inherit sysadmin
Security 963