Users Guide

The linuxadmin password configured from the CLI takes precedence across reboots over the password configured from the
Linux shell.
Verify the linuxadmin password using the show running-configuration command.
OS10# show running-configuration
system-user linuxadmin password
$6$5DdOHYg5$JCE1vMSmkQOrbh31U74PIPv7lyOgRmba1IxhkYibppMXs1KM4Y.gbTPcxyMP/PHUkMc5rdk/
ZLv9Sfv3ALtB61
Disable linuxadmin user
To disable or lock the linuxadmin user, use the system-user linuxadmin disable command in CONFIGURATION
mode.
OS10(config)# system-user linuxadmin disable
To re-enable or unlock the linuxadmin user, use the no system-user linuxadmin disable command in
CONFIGURATION mode.
OS10(config)# no system-user linuxadmin disable
Privilege levels
Controlling terminal access to a switch is one method of securing the device and network. To increase security, you can limit
user access to a subset of commands using privilege levels.
Configure privilege levels, add commands to them, and restrict access to the command line with passwords. The system
supports 16 privilege levels:
● Level 0—Provides users the least privilege, restricting access to basic commands.
● Level 1—Provides access to a set of show commands and certain operations such as ping, traceroute, and so on.
● Level 15—Provides access to all available commands for a particular user role.
● Levels 0, 1, and 15—System configured privilege levels with a predefined command set.
● Levels 2 to 14—Not configured. You can customize these levels for different users and access rights.
Privilege levels inherit the commands supported on all lower levels. After logging in with a user role, a user has access to
commands assigned to his privilege level and lower levels.
For users assigned to the sysadmin, netadmin, and secadmin roles, you cannot configure a privilege level lower than 2. You
can configure netoperator users with privilege levels 0 or 1.
After you assign commands to privilege levels, assign the privilege level to users with the username command. Use the
enable password privilege-level command to switch between privilege levels and access the commands supported
at each level. The disable command takes the user to a lower level.
When a remote user logs in, OS10 checks for a match in the local system. If a local user entry is found, the privilege level of the
local user is applied to the remote user for the login session. If no match is found in the local system, OS10 assigns a default
privilege level according to the role of the remote user:
● sysadmin, secadmin, and netadmin roles: Level 15
● netoperator role: Level 1
NOTE: The role of a local user in the system and the remote user who logs in must be the same at both ends.
Configure privilege levels
To restrict CLI access, create the required privilege levels for user roles, assign commands to each level, and assign privilege
levels to users.
1. Create privilege levels in CONFIGURATION mode.
privilege mode priv-lvl privilege-level command-string
● mode — Enter the privilege mode used to access CLI modes:
○ exec — Accesses EXEC mode.
Security
1303