Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Carts

Dell SmartFabric OS10 User Guide Release 10.5.4

PDF

Privilege levels

Controlling terminal access to a switch is one method of securing the device and network. To increase security, you can limit user access to a subset of commands using privilege levels.

Configure privilege levels, add commands to them, and restrict access to the command line with passwords. The system supports 16 privilege levels:

  • Level 0—Provides users the least privilege, restricting access to basic commands.
  • Level 1—Provides access to a set of show commands and certain operations such as ping, traceroute, and so on.
  • Level 15—Provides access to all available commands for a particular user role.
  • Levels 0, 1, and 15—System configured privilege levels with a predefined command set.
  • Levels 2 to 14—Not configured. You can customize these levels for different users and access rights.

Privilege levels inherit the commands supported on all lower levels. After logging in with a user role, a user has access to commands assigned to his privilege level and lower levels.

For users assigned to the sysadmin, netadmin, and secadmin roles, you cannot configure a privilege level lower than 2. You can configure netoperator users with privilege levels 0 or 1.

After you assign commands to privilege levels, assign the privilege level to users with the username command. Use the enable password privilege-level command to switch between privilege levels and access the commands supported at each level. The disable command takes the user to a lower level.

When a remote user logs in, OS10 checks for a match in the local system. If a local user entry is found, the privilege level of the local user is applied to the remote user for the login session. If no match is found in the local system, OS10 assigns a default privilege level according to the role of the remote user:
  • sysadmin, secadmin, and netadmin roles: Level 15
  • netoperator role: Level 1
NOTE: The role of a local user in the system and the remote user who logs in must be the same at both ends.

Starting for Release 10.5.4.4, OS10 RADIUS client can process the privilege level attribute. The privilege level attribute is treated as a Dell vendor-specific TLV attribute. If the RADIUS server sends the privilege level attribute for a user, OS10 RADIUS client extracts the privilege level value from the RADIUS packet and configures the privilege level for the user accordingly. Use the show users and show privilege commands to view the privilege level configured for different users. In the previous releases, OS10 can only process the role attribute from RADIUS servers.

You must configure the privilege level on the RADIUS server using the vendor-specific attribute (VSA). The vendor ID of Dell Technologies is 674. Create a VSA with Name = DellEMC-AVpair, OID = 1, Type = string. For example, to set the privilege level of a user to 6, enter VSA as follows: DellEMC-AVpair := "6".

The following is a sample output of the privilege level attribute that is captured from a RADIUS server packet with the privilege level value set to 6 for a user. 

Vendor-Specific Attribute (26), length: 9, Value:Vendor: Unknown (674)
Vendor Attribute: 1, Length: 1, Value: 6

The following is the show users output taken on the OS10 device after the privilege level attribute has been set to a value of 6 from the RADIUS server for a username user1. 

OS10# show users
Index Line  User   Role     Application  Idle  Login-Time  Location                     Privilege-Level
----- ----- ------ -------- ------------ ----- ----------- ---------------------------- ---------------
1     ttyS0 admin  sysadmin clish        2.7s  2022-09-30  T 10:10:46Z console          15
2     pts/0 user1  sysadmin bash         45.8s 2022-09-30  T 10:10:05Z 10.10.10.10 [ssh] 6

Rate this content

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please provide ratings (1-5 stars).
  Please select whether the article was helpful or not.
  Comments cannot contain these special characters: <>()\