Specifications

2-268
Cisco SCE 2000 and SCE 1000 CLI Command Reference
OL-26797-03
Chapter 2 CLI Command Reference
sce-url-database protection
Command History This table includes the following release-specific history entries:
Usage Guidelines When the protected URL database is protected, one user is designated as the owner of the database and
only that user can execute the protection CLI commands on the database; the database manipulation
commands then being restricted according to the owner configuration. This requires defining the AAA
authorization method (either based on local users or based on a TACACS+ server, etc.) and defining at
least one user who should be assigned to be the owner of the database.
If the database is defined to be protected, none of the database information (including the owner, the
database entries, and the authorization information itself) is accessible to any users, including the
relevant saved configuration in the log files and in the relevant SCA BB reports. The database-owner
user may change the authorizations using the CLI; however, when any of the protections are relaxed (or
all of the protections are relaxed by removing the protections entirely) the database is reset.
In order to ensure the secrecy of the database information, the database entries may be imported to the
SCE (using the CLI) in an encrypted form using 128-, 192-, or 256-bit key length AES. The key may be
set or updated using the appropriate CLI command; typically, this command should be run over a secure
Telnet session.
User Authorization Guidelines:
• The default user cannot be the owner.
• When there is no designated owner, the sce-url-database is unprotected and the contents can be read
and modified by any user.
• Only the owner can configure the protection settings. If there is no owner, the database is
unprotected and any user has read and write permissions. A user may be configured to be the owner
of the database only while no owner user is designated for the database.
• When any protection setting is relaxed, the database is reset. Protection is relaxed in the following
cases:
– Protection is removed completely using the no sce-url-database protection command.
– Write permission is changed from owner-only to all-users.
– Lookup permission is changed from no-user to owner-only.
• The sce-url-database configuration information is not accessible as part of the running config and
startup config files.
– Protected information is not displayed when a show or more command is executed on the config
files.
– Protected information is included when a copy command is executed on the config files.
Authorization: admin
Examples The following example shows how to configure protected URL database protection.
SCE>enable 10
Password:<cisco>
SCE#>configure
SCE(config)#interface linecard 0
SCE(config if)#
sce-url-database protection owner myself
Release Modification
3.5.0 This command was introduced.