HP 6125XLG Command Reference Manual page 75

feature [ feature-name ]: Specifies one or all features. The feature-name argument specifies a feature
name. If no feature name is specified, you specify all the features in the system. When you specify a
feature, you must enter its name exactly as displayed by display role feature, including the case.
feature-group feature-group-name: Specifies a user-defined or pre-defined feature group. The
feature-group-name argument represents the feature group name, a case-sensitive string of 1 to 31
characters. If the feature group has not been created, the rule takes effect after the group is created. To
display the feature groups that have been created, use the display role feature-group command.
xml-element [ xml-string ]: Specifies an XML element. The xml-string argument represents the XPath of the
XML element, a case-insensitive string of 1 to 512 characters. Use the slash (/) to separate Xpath items,
for example, Interfaces/Index/Name. If you do not specify any XML element, the rule applies to all XML
elements.
all: Deletes all the user role rules.
Usage guidelines
You can define the following types of rules for different access control granularities:
• Command rule—Controls access to a command or a set of commands that match a regular
expression.
Feature rule—Controls access to the commands of a feature by command type.
•
Feature group rule—Controls access to the commands of a group of features by command type.
•
XML element rule—Controls access to XML elements.
•
A user role can access the set of permitted commands specified in its rules. User role rules include
predefined (identified by sys-n) and user-defined user role rules.
If two user-defined rules of the same type conflict, the one with the higher ID takes effect. For
•
example, if rule 1 permits the ping command, rule 2 permits the tracert command, and rule 3
denies the ping command, the user role can use the tracert command but not the ping command.
If a predefined user role rule and a user-defined user role rule conflict, the user-defined user role rule
•
takes effect.
You can configure up to 256 user-defined rules for a user role, but the total number of user-defined user
role rules in the system cannot exceed 1024.
Any rule modification, addition, or removal for a user role takes effect only on the users who log in with
the user role after the change.
Access to the file system commands is restricted by both the file system command rules and the file system
feature rule.
A command with output redirection to the file system is permitted only when the command type write is
assigned to the file system feature.
When you specify a command string, follow the guidelines in Table
67
8.