Users Guide

The following example displays the privilege levels of all users who are logged into OS10:
OS10# show users
Index Line User Role Application Idle Login-Time Location Privilege
----- ------ ----- ----- ----------- ---- ----------- -------- ---------
1 pts/0 admin sysadmin bash >24h 2018-09-08 T06:51:37Z 10.14.1.91 [ssh] 15
2 pts/1 netad netadmin bash >24h 2018-09-08 T06:54:33Z 10.14.1.91 [ssh] 10
Congure enable password
After you congure privilege levels for users, assign commands to each level and an enable password to access each level:
1 Congure a privilege level and assign commands to it in CONFIGURATION mode.
privilege mode priv-lvl privilege-level command-string
• mode — Enter the privilege mode used to access CLI modes:
– exec — Accesses EXEC mode.
– configure — Accesses class-map, DHCP, logging, monitor, openow, policy-map, QOS, support-assist, telemetry, CoS,
Tmap, UFD, VLT, VN, VRF, WRED, and alias modes.
– interface — Accesses Ethernet, bre-channel, loopback, management, null, port-group, lag, breakout, range, port-channel,
and VLAN modes.
–
route-map — Accesses route-map mode.
– router — Accesses router-bgp and router-ospf modes.
– line — Accesses line-vty mode.
• priv-lvl privilege-level — Enter the number of a privilege level, from 2 to 14.
• command-string — Enter the command supported at the privilege level.
For sysadmin, netadmin, and secadmin roles, you cannot congure a privilege level less than 2 .
2 Congure an enable password for each privilege level in CONFIGURATION mode.
enable password encryption-type password-string priv-lvl privilege-level
• encryption-type — Enter an encryption type for the password entry:
– 0 — Use plain text with no password encryption.
– sha-256 — Encrypt the password using the SHA-256 algorithm.
– sha-512 — Encrypt the password using the SHA-512 algorithm.
• priv-lvl privilege-level — Enter a privilege level, from 1 to 15.
OS10(config)# privilege exec priv-lvl 3 "show version"
OS10(config)# enable password 0 P@$$w0Rd priv-lvl 3
OS10(config)# privilege exec priv-lvl 12 "configure terminal"
OS10(config)# privilege configure priv-lvl 12 route-map
OS10(config)# privilege route-map priv-lvl 12 "set local-preference"
OS10(config)# enable password sha-256 $5$2uThib1o$84p.tykjmz/w7j26ymoKBjrb7uepkUB priv-lvl 12
Audit log
To monitor user activity and conguration changes on the switch, enable the audit log. Only the sysadmin and secadmin roles can
enable, view, and clear the audit log.
The audit log records conguration and security events, including:
• User logins and logouts on the switch, failed logins, and concurrent login attempts by a user
• User-based conguration changes recorded with the user ID, date, and time of the change. The specic parameter changes are not
logged.
944
Security