EMC® VNX® Series Security Configuration Guide for VNX

CLI role-based access setup

A user account is always associated with a primary group and each group is assigned a role. A role defines the privileges (that is, the operations) the user can perform on a particular File object.

Defining role-based access for commands

This appendix provides information about how to setup role-based access for CLI commands. The first four tables list the CLI commands for which you can specify the privileges needed to perform different command actions. The object on which privileges are defined and the specific command actions available when Modify or Full Control privileges are selected are listed for each command. Using this information you can create a custom role (also known as a user role) that gives a user associated with this role exactly the privileges necessary to perform his job. Or you can associate a user with the predefined role that already includes Full Control privileges for the command. The first table lists the commands with the prefix cel. The second table lists the commands with the prefix fs. The third table lists the commands with the prefix nas. And the fourth table lists the commands with the prefix server.

You create and manage role-based administrative access with Settings > Security > User Management > Local Users for File > Roles or Settings > Security > User Management > User Customization for File > Roles. You must be root or a user associated with the Administrator or Security Administrator role to create a user account and to associate it with a group and role.

Read-only privileges

Regardless of the role with which he is associated, a user always has read-only privileges for all commands and command options that display information. Some of the command actions available with read-only privileges include info, list, status, and verify. The fifth table lists commands that users associated with any role can execute.

Commands not covered by the role-based access feature

The final table lists the commands that are not covered by the role-based access feature. Some of these commands invoke scripts, others are based on legacy executables, and others are associated with File objects that are not exposed. If the File object associated with a command is not exposed in Create Role, you cannot create a custom (user) role that allows you to specify the privileges needed to perform different command actions. Consequently these commands can only be performed by the default user accounts root and nasadmin or, in some cases, by a user account associated with the root and nasadmin roles.