User Role Assignment - HP 5920 series Fundamentals Configuration Manual

User role name
level-n (n = 0 to 15)
security-audit

User role assignment

You assign access rights to a user by assigning at least one user role. The user can use the collection of
items and resources accessible to any user role assigned to the user. For example, you can access any
interface to use the qos apply policy command if you are assigned the following user roles:
• User role A denies access to the qos apply policy command and permits access only to interface
Ten-GigabitEthernet 1/0/1.
User role B permits access to the qos apply policy command and all interfaces.
•
Depending on the authentication method, user role assignment has the following methods:
AAA authorization—If scheme authentication is used, the AAA module handles user role
•
assignment.
If the user passes local authorization, the device assigns the user roles specified in the local user
account.
Permissions
•
level-0—Has access to diagnostic commands, including ping, quit,
ssh2, super, system-view, telnet, and tracert. Level-0 access rights are
configurable.
•
level-1—Has access to the display commands (except display
history-command all) of all features and resources in the system, in
addition to all access rights of the user role level-0. Level- 1 access rights
are configurable.
•
level-2 to level-8, and level-10 to level-14—Do not have access rights by
default. Access rights are configurable.
•
level-9—Has access to all features and resources except those in the
following list. If you are logged in with a local user account that has a
level-9 user role, you can change the password in the local user account.
Level-9 access rights are configurable.
RBAC non-debugging commands.
Local users.
File management.
Device management.
The display history-command all command.
•
level-15—Has the same rights as network-admin.
Security log manager. The user role has the following access rights to
security log files:
•
Access to the commands for displaying and maintaining security log
files (for example, the dir, display security-logfile summary, and more
commands).
•
Access to the commands for managing security log files and security log
file system (for example, the info-center security-logfile directory, mkdir,
and security-logfile save commands).
For more information about security log management, see Network
Management and Monitoring Configuration Guide. For more information
about file system management, see
IMPORTANT:
Only the security-audit user role has access to security log files.
52
"Managing the file system."