Assigning User Roles - HP 6125XLG Configuration Manual

User role name
level-n (n = 0 to 15)
security-audit

Assigning user roles

You assign access rights to users by assigning at least one user role. The users can use the collection of
commands and resources accessible to any user role assigned to them. For example, user role A denies
access to the qos apply policy command and permits access to only interface Ten-GigabitEthernet
1/1/5, and user role B permits access to the qos apply policy command and all interfaces. With these
two user roles, you can access any interface to use the qos apply policy command.
Depending on the authentication method, user role assignment has the following methods:
AAA authorization—If scheme authentication is used, the AAA module handles user role
•
assignment.
If the user passes local authorization, the device assigns the user roles specified in the local user
account.
If the user passes remote authorization, the remote AAA server assigns the user roles specified
on the server to the user. The AAA server can be a RADIUS or HWTACACS server.
None-AAA authorization—If the user uses password authentication or no authentication, the device
•
assigns user roles specified on the user interface. This method also applies to SSH clients that use
publickey or password-publickey authentication. User roles assigned to these SSH clients are
specified in their respective local device management user accounts.
Permissions
•
level-0—Has access to the commands of ping, quit, ssh2, super,
system-view, telnet, and tracert. Level-0 access rights are configurable.
•
level-1—Has access to the display commands (except display
history-command all) of all features and resources in the system, in addition
to all access rights of the user role level-0. Level- 1 access rights are
configurable.
•
level-2 to level-8, and level-10 to level-14—Have no access rights by default.
Access rights are configurable.
•
level-9—Has access to all features and resources except RBAC (debugging
commands excluded), local users, file management, device management,
and the display history-command all command. Level-9 access rights are
configurable.
•
level-15—Has the same access rights as the role network-admin.
Security log manager. The user role has access to security log files:
•
It has access to the commands for displaying and maintaining security log
files, for example, the dir, display security-logfile summary, and more
commands.
•
It has access to the commands for managing security log files and security log
file system, for example, the info-center security-logfile directory, mkdir, and
security-logfile save commands.
For more information about security log management, see Network
Management and Monitoring. For more information about file system
management, see "Managing the file
IMPORTANT:
Only the security-audit user role has access to security log files. Other user roles
do not have the access right even if you have configured the user roles to have
the access permission.
44
system."