Dell PowerSwitch S5212F-ON EMC SmartFabric OS10 User Guide Release 10.5.0 - Page 975

Create user and assign role OS10(config)# username smith password silver403! role sysadmin View users OS10# show users Index Line User 1 ttyS root 2 pts/0 admin Role Application Idle root -bash >24h sysadmin bash 1.1s Login-Time 2018-05-23 T23:05:03Z 2018-05-30 T20:04:27Z Location console 10.14.1.214[ssh] Unknown user role When a RADIUS or TACACS+ server authenticates a user, it may return an unknown user role, or the role may be missing. In these cases, OS10 assigns the netoperator role and associated permissions to the user by default. You can reconfigure the default assigned role. In addition, you can configure an unknown RADIUS or TACACS+ user-role name to inherit the permissions of an existing OS10 systemdefined role. • Reconfigure the default OS10 user role in CONFIGURATION mode. userrole {default | name} inherit existing-role-name ○ default inherit - Reconfigure the default permissions assigned to an authenticated user with a missing or unknown role. ○ name inherit - Enter the name of the RADIUS or TACACS+ user role that inherits permissions from an OS10 user role; 32 characters maximum. ○ existing-role-name - Assign the permissions associated with an existing OS10 user role: ▪ sysadmin - Full access to all commands in the system, exclusive access to commands that manipulate the file system, and access to the system shell. A system administrator can create user IDs and user roles. ▪ secadmin - Full access to configuration commands that set security policy and system access, such as password strength, AAA authorization, and cryptographic keys. A security administrator can display security information, such as cryptographic keys, login statistics, and log information. ▪ netadmin - Full access to configuration commands that manage traffic flowing through the switch, such as routes, interfaces, and ACLs. A network administrator cannot access configuration commands for security features or view security information. ▪ netoperator - Access to EXEC mode to view the current configuration with limited access. A network operator cannot modify any configuration setting on a switch. Reconfigure permissions for an unknown user role OS10(config)# userrole default inherit sysadmin Configure permissions for a RADIUS or TACACS+ user role OS10(config)# userrole tacacsadmin inherit netadmin Enable user lockout By default, a maximum of three consecutive failed password attempts is supported on the switch. You can set a limit to the maximum number of allowed password retries with a specified lockout period for the user ID. This feature is available only for the sysadmin and secadmin roles. • Configure user lockout settings in CONFIGURATION mode. password-attributes {[max-retry number ] [lockout-period minutes]} ○ max-retry number - Sets the maximum number of consecutive failed login attempts for a user before the user is locked out, from 0 to 16; default 3. ○ lockout-period minutes - Sets the amount of time that a user ID is prevented from accessing the system after exceeding the maximum number of failed login attempts, from 0 to 43,200; default 0. Security 975