Users Guide

Enable login statistics
To monitor system security, allow users to view their own login statistics when they sign in to the system. A large number of login failures or
an unusual login location may indicate a system hacker. Enable the display of login information after a user successfully logs in; for example:
OS10 login: admin
Password:
Last login: Thu Nov 2 16:02:44 UTC 2017 on ttyS1
Linux OS10 3.16.43 #2 SMP Debian 3.16.43-2+deb8u5 x86_64
...
Time-frame for statistics : 25 days
Role changed since last login : false
Failures since last login : 0
Failures in time period : 1
Successes in time period : 14
OS10#
This feature is available only for the sysadmin and secadmin roles.
• Enable the display of login information in CONFIGURATION mode.
login-statistics enable
To display information about user logins, use the show login-statistics command.
Enable login statistics
OS10(config)# login-statistics enable
To disable login statistics, use the no login-statistics enable command.
Privilege levels
Controlling terminal access to a switch is one method of securing the device and network. To increase security, you can limit user access to
a subset of commands using privilege levels.
Congure privilege levels, add commands to them, and restrict access to the command line with passwords. The system supports 16
privilege levels:
• Level 0—Provides users the least privilege, restricting access to basic commands.
• Level 1—Provides access to a set of show commands and certain operations such as ping, traceroute, and so on.
• Level 15—Provides access to all available commands for a particular user role.
• Levels 0, 1, and 15—System congured privilege levels with a predened command set.
• Levels 2 to 14—Not congured. You can customize these levels for dierent users and access rights.
Privilege levels inherit the commands supported on all lower levels. After logging in with a user role, a user has access to commands
assigned to his privilege level and lower levels.
For users assigned to the sysadmin, netadmin, and secadmin roles, you cannot congure a privilege level lower than 2. You can
congure
netoperator users with privilege levels 0 or 1.
After you assign commands to privilege levels, assign the privilege level to users with the username command. Use the enable
password privilege-level
command to switch between privilege levels and access the commands supported at each level. The
disable command takes the user to a lower level.
When a remote user logs in, OS10 checks for a match in the local system. If a local user entry is found, the privilege level of the local user is
applied to the remote user for the login session. If no match is found in the local system, OS10 assigns a default privilege level according to
the role of the remote user:
• sysadmin, secadmin, and netadmin roles: Level 15
942
Security