Dell PowerSwitch S5212F-ON EMC SmartFabric OS10 User Guide Release 10.5.0 - Page 1016

boot protect enable username password Allows you to enable bootloader protection. Syntax Parameters boot protect enable username username password password • username - Enter the username to provide access to bootloader protection. • password - Enter a password for the specified username. Default Disabled Command Mode EXEC Usage Information You can enable bootloader protection by executing this command. You can configure a maximum of three username / password pairs for bootloader protection. Example OS10# boot protect enable username root password calvin Supported Releases 10.4.3.0 or later show boot protect Displays the current list of configured users that have access to bootloader protection. Syntax show boot protect Parameters None Default Not configured Command Mode EXEC Usage Information Displays the current list of authorised users for bootloader protection, but hides their passwords for security reasons. Example (Disabled) OS10# show boot protect Boot protection disabled Example (Enabled) OS10# show boot protect Boot protection enabled Authorized users: root linuxadmin admin Supported Releases 10.4.3.0 or later X.509v3 certificates OS10 supports X.509v3 certificates to secure communications between the switch and a host, such as a RADIUS server. Both the switch and the server exchange a public key in a signed X.509v3 certificate issued by a certificate authority (CA) to authenticate each other. The certificate authority uses its private key to sign the switch and host certificates. The information in the certificate allows both devices to prove ownership and the validity of a public key. Assuming the CA is trusted, the switch and authentication server validate each other's identity and set up a secure, encrypted communications channel. User authentication with a public key certificate is usually preferred over password-based authentication, although you can use both at the same time, to: • Avoid the security risk of using low-strength passwords and provide greater resistance to brute-force attacks. • Provide assurance of trusted, provable identities (when using certificates digitally signed by a trusted CA). • Provide security and confidentiality in switch-server communications in addition to user authentication. For example, you can download and install a X.509v3 certificate to enable public-key authentication in RADIUS over TLS authentication - also called RadSec. OS10 supports a public key infrastructure (PKI), including: • Generation of self-signed certificates and certificate signing requests (CSRs), and their corresponding private keys 1016 Security