Connectivity Guide

◦ sysadmin — Full access to all commands in the system, exclusive access to commands that manipulate the le system, and
access to the system shell. A system administrator can create user IDs and user roles.
◦ secadmin — Full access to conguration commands that set security policy and system access, such as password strength,
AAA authorization, and cryptographic keys. A security administrator can display security information, such as cryptographic
keys, login statistics, and log information.
◦
netadmin — Full access to conguration commands that manage trac owing through the switch, such as routes,
interfaces, and ACLs. A network administrator cannot access conguration commands for security features or view security
information.
◦ netoperator — Access only to EXEC mode to view the current conguration. A network operator cannot modify any
conguration setting on a switch.
Recongure permissions for an unknown TACACS+ user role
OS10(config)# userrole default inherit sysadmin
Congure permissions for a TACACS+ user role
OS10(config)# userrole tacacsadmin inherit netadmin
SSH server
In OS10, the secure shell (SSH) server allows an SSH client to access an OS10 switch through a secure, encrypted connection. The SSH
server authenticates remote clients using RADIUS challenge/response, a trusted host le, locally-stored passwords, and public keys.
Congure SSH server
• The SSH server is enabled by default. You can disable the SSH server using the no ip ssh server enable command.
• Challenge response authentication is disabled by default. To enable, use the ip ssh server challenge-response-
authentication command.
• Host-based authentication is disabled by default. To enable, use the ip ssh server hostbased-authentication command.
• Password authentication is enabled by default. To disable, use the no ip ssh server password-authentication command.
• Public key authentication is enabled by default. To disable, use the no ip ssh server pubkey-authentication command.
• Password-less login is disabled by default. To enable, use the username sshkey or username sshkey filename commands.
• Congure the list of cipher algorithms using the ip ssh server cipher cipher-list command.
• Congure Key Exchange algorithms using the ip ssh server kex key-exchange-algorithm command.
• Congure hash message authentication code (HMAC) algorithms using the ip ssh server mac hmac-algorithm command.
• Congure the SSH server listening port using the ip ssh server port port-number command.
• Congure the SSH server to be reachable on the management VRF using the ip ssh server vrf command.
• Congure the SSH login timeout using the ip ssh server login-grace-time seconds command, from 0 to 300; default 60.
To reset the default SSH prompt timer, use the no ip ssh server login-grace-time command.
• Congure the maximum number of authentication attempts using the ip ssh server max-auth-tries number command,
from 0 to 10; default 6. To reset the default, use the no ip ssh server max-auth-tries command.
The max-auth-tries value includes all authentication attempts, including public-key and password. If you enable both, public-key
based authentication and password authentication, the public-key authentication is the default and is tried rst. If it fails, the number of
max-auth-tries is reduced by one. In this case, if you congured ip ssh server max-auth-tries 1, the password prompt
does not display.
Regenerate public keys
When enabled, the SSH server generates public keys by default and uses them for client authentication:
• A Rivest, Shamir, and Adelman (RSA) key using 2048 bits.
• An Elliptic Curve Digital Signature Algorithm (ECDSA) key using 256 bits
618
System management