Configuring Role-Based Access Control. Cisco UCS Manager CLI
โฆษณา
โฆษณา
C H A P T E R
9
Configuring Role-Based Access Control
This chapter includes the following sections:
•
Role-Based Access Control Overview, page 177
•
User Accounts for Cisco UCS , page 177
•
•
•
Configuring User Roles, page 186
•
•
Configuring Locally Authenticated User Accounts, page 192
•
Password Profile for Locally Authenticated Users, page 199
•
Monitoring User Sessions from the CLI, page 202
Role-Based Access Control Overview
Role-Based Access Control (RBAC) is a method of restricting or authorizing system access for users based on user roles and locales. A role defines the privileges of a user in the system and a locale defines the organizations (domains) that a user is allowed access. Because users are not directly assigned privileges, you can manage individual user privileges by assigning the appropriate roles and locales.
A user is granted write access to the required system resources only if the assigned role grants the access privileges and the assigned locale allows access. For example, a user with the Server Administrator role in the engineering organization can update server configurations in the Engineering organization. They cannot, however, update server configurations in the Finance organization, unless the locales assigned to the user include the Finance organization.
User Accounts for Cisco UCS
User accounts access the system. You can configure up to 48 local user accounts in each Cisco UCS Manager domain. Each user account requires a unique username and password.
Cisco UCS Manager CLI Configuration Guide, Release 2.2
177
Configuring Role-Based Access Control
Guidelines for Cisco UCS Usernames
You can set user accounts with an SSH public key. The public key can be set in either of the two formats:
OpenSSH or SECSH.
Admin Account
An admin account comes with each Cisco UCS domain. The admin account is a default user account and cannot be modified or deleted. This account is the system administrator or superuser account s full privileges.
There is no default password assigned to the admin account; you must choose the password during the initial system setup.
The admin account is always active and does not expire. You cannot configure the admin account as inactive.
Locally Authenticated User Accounts
A locally authenticated user account is authenticated directly through the fabric interconnect and can be enabled or disabled by anyone with admin or aaa privileges. After a local user account is disabled, the user cannot log in. The database does not delete the configuration details for disabled local user accounts. If you re-enable a disabled local user account, the account becomes active with the existing configuration, including the username and password.
Remotely Authenticated User Accounts
A remotely authenticated user account is any user account that is authenticated through LDAP, RADIUS, or
TACACS+.
If a user maintains a local user account and a remote user account simultaneously, the roles defined in the local user account override those maintained in the remote user account.
Expiration of User Accounts
You can configure user accounts to expire at a predefined time. When the expiration time is reached, the user account is disabled.
By default, user accounts do not expire.
Note
After you configure a user account with an expiration date, you cannot reconfigure the account to not expire. However, you can configure the account to use the latest expiration date available.
Guidelines for Cisco UCS Usernames
The username is also used as the login ID for Cisco UCS Manager. When you assign login IDs to Cisco UCS user accounts, consider the following guidelines and restrictions:
• The login ID can contain between 1 and 32 characters, including the following:
◦Any alphabetic character
◦Any digit
◦_ (underscore)
◦- (dash)
◦. (dot)
178
Cisco UCS Manager CLI Configuration Guide, Release 2.2
Configuring Role-Based Access Control
Reserved Words: Locally Authenticated User Accounts
• The login ID must be unique within Cisco UCS Manager.
• The login ID must start with an alphabetic character. It cannot start with a number or a special character, such as an underscore.
• The login ID is case-sensitive.
• You cannot create an all-numeric login ID.
• After you create a user account, you cannot change the login ID. You must delete the user account and create a new one.
Reserved Words: Locally Authenticated User Accounts
You cannot use the following words when creating a local user account in Cisco UCS.
• root
• bin
• daemon
• adm
• lp
• sync
• shutdown
• halt
• news
• uucp
• operator
• games
• gopher
• nobody
• nscd
• mailnull
• rpcuser
• rpc
• mtsuser
• ftpuser
• ftp
• man
• sys
Cisco UCS Manager CLI Configuration Guide, Release 2.2
179
Configuring Role-Based Access Control
Guidelines for Cisco UCS Passwords
• samdme
• debug
Guidelines for Cisco UCS Passwords
Each locally authenticated user account requires a password. A user with admin or aaa privileges can configure
Cisco UCS Manager to perform a password strength check on user passwords. Listed in
Table 7: ASCII Table of Allowed Characters for UCS Passwords, on page 180
are the allowed ASCII characters for UCS passwords.
Table 7: ASCII Table of Allowed Characters for UCS Passwords
*
+
)
(
'
%
&
-
,
.
:
/
;
!
"
ASCII Printable Characters
A-Z a-z
0-9
Description
uppercase letters A to Z lowercase letters a to z digits 0 to 9 exclamation mark quotation mark percent sign ampersand apostrophe left parenthesis right parenthesis asterisk plus sign comma hyphen period slash colon semicolon
180
Cisco UCS Manager CLI Configuration Guide, Release 2.2
Configuring Role-Based Access Control
Guidelines for Cisco UCS Passwords
|
{
}
~
`
_
]
^
\
[
@
ASCII Printable Characters
<
>
Description
less-than greater-than at sign left square bracket backslash right square bracket caret underscore grave accent left curly brace vertical bar right curly brace tilde
Cisco recommends using a strong password; otherwise, the password strength check for locally authenticated users, Cisco UCS Manager rejects any password that does not meet the following requirements:
• Must contain a minimum of eight characters and a maximum of 80 characters.
• If the password strength check is turned on, the minimum password length is variable and can be set from a minimum of 6 to a maximum of 80 characters.
Note
The default is 8 characters.
• Must contain at least three of the following:
◦Lower case letters
◦Upper case letters
◦Digits
◦Special characters
• Must not contain a character that is repeated more than three times consecutively, such as aaabbb.
• Must not be identical to the username or the reverse of the username.
Cisco UCS Manager CLI Configuration Guide, Release 2.2
181
Configuring Role-Based Access Control
Web Session Limits for User Accounts
• Must pass a password dictionary check. For example, the password must not be based on a standard dictionary word.
• Must not contain the following symbols: $ (dollar sign), ? (question mark), and = (equals sign).
• Should not be blank for local user and admin accounts.
Web Session Limits for User Accounts
Cisco UCS Manager uses web session limits to restrict the number of web sessions (both GUI and XML) that a given user account is permitted to access at any one time.
Each Cisco UCS Manager domain supports a maximum of 32 concurrent web sessions per user and 256 total user sessions. By default, the number of concurrent web sessions allowed by Cisco UCS Manager is set to 32 per user, but you can configure this value up to the system maximum of 256.
User Roles
User roles contain one or more privileges that define the operations that are allowed for a user. You can assign one or more roles to each user. Users with multiple roles have the combined privileges of all assigned roles.
For example, if Role1 has storage-related privileges, and Role 2 has server-related privileges, users with Role1 and Role 2 have both storage-related and server-related privileges.
A Cisco UCS domain can contain up to 48 user roles, including the default user roles. Any user roles configured after the first 48 are accepted, but they are inactive with faults raised.
All roles include read access to all configuration settings in the Cisco UCS domain. Users with read-only roles cannot modify the system state.
You can create, modify or remove existing privileges, and delete roles. When you modify a role, the new privileges apply to all users with that role. Privilege assignment is not restricted to the privileges defined for the default roles. Meaning, you can use a custom set of privileges to create a unique role. For example, the default Server Administrator and Storage Administrator roles have a different set of privileges. However, you can create a Server and Storage Administrator role that combines the privileges of both roles.
Note
If you delete a role after it was assigned to users, it is also deleted from those user accounts.
Modify the user profiles on AAA servers (RADIUS or TACACS+) to add the roles corresponding to the privileges granted to that user. The attribute stores the role information. The AAA servers return this attribute with the request and parse it to obtain the roles. LDAP servers return the roles in the user profile attributes.
Note
If a local and a remote user account have the same username, Cisco UCS Manager overrides any roles assigned to the remote user with those assigned to the local user.
Default User Roles
The system contains the following default user roles:
182
Cisco UCS Manager CLI Configuration Guide, Release 2.2
Configuring Role-Based Access Control
Reserved Words: User Roles
AAA Administrator
Read-and-write access to users, roles, and AAA configuration. Read access to the remaining system.
Administrator
Complete read-and-write access to the entire system. Assigns this role to the default administrator account by default. You cannot change it.
Facility Manager
Read-and-write access to power management operations through the power management privilege.
Read access to the remaining system.
Network Administrator
Read-and-write access to fabric interconnect infrastructure and network security operations. Read access to the remaining system.
Operations
Read-and-write access to systems logs, including the syslog servers, and faults. Read access to the remaining system.
Read-Only
Read-only access to system configuration with no privileges to modify the system state.
Server Compute
Read and write access to most aspects of service profiles. However, the user cannot create, modify or delete vNICs or vHBAs.
Server Equipment Administrator
Read-and-write access to physical server-related operations. Read access to the remaining system.
Server Profile Administrator
Read-and-write access to logical server-related operations. Read access to the remaining system.
Server Security Administrator
Read-and-write access to server security-related operations. Read access to the remaining system.
Storage Administrator
Read-and-write access to storage operations. Read access to the remaining system.
Reserved Words: User Roles
You cannot use the following words when creating custom roles in Cisco UCS.
• network-admin
• network-operator
Cisco UCS Manager CLI Configuration Guide, Release 2.2
183
Configuring Role-Based Access Control
Privileges
• vdc-admin
• vdc-operator
• server-admin
Privileges
Privileges give users, assigned to user roles, access to specific system resources and permission to perform specific tasks. The following table lists each privilege and the user role given that privilege by default.
Tip
Detailed information about these privileges and the tasks that they enable users to perform is available in
Privileges in Cisco UCS available at the following URL: http://www.cisco.com/en/US/products/ps10281/ prod_technical_reference_list.html
.
Table 8: User Privileges
Privilege
aaa admin ext-lan-config ext-lan-policy ext-lan-qos ext-lan-security ext-san-config ext-san-policy ext-san-qos ext-san-security fault operations org-management pod-config pod-policy
Description
System security and AAA
System administration
External LAN configuration
External LAN policy
External LAN QoS
External LAN security
External SAN configuration
External SAN policy
External SAN QoS
External SAN security
Alarms and alarm policies
Logs and Smart Call Home
Organization management
Pod configuration
Pod policy
Default Role Assignment
AAA Administrator
Administrator
Network Administrator
Network Administrator
Network Administrator
Network Administrator
Storage Administrator
Storage Administrator
Storage Administrator
Storage Administrator
Operations
Operations
Operations
Network Administrator
Network Administrator
184
Cisco UCS Manager CLI Configuration Guide, Release 2.2
Configuring Role-Based Access Control
Privileges
Privilege
pod-qos pod-security power-mgmt
Description
Pod QoS
Pod security
Default Role Assignment
Network Administrator
Network Administrator read-only
Read-and-write access to power management operations
Facility Manager
Read-only access
Read-only cannot be selected as a privilege; it is assigned to every user role.
Read-Only
Server hardware management
Server maintenance
Server Equipment Administrator
Server Equipment Administrator server-equipment server-maintenance server-policy server-security service-profile-compute service-profile-config service-profile-config-policy service-profile-ext-access service-profile-network service-profile-network-policy service-profile-qos
Server policy
Server security
Service profile endpoint access
Service profile network
Service profile network policy
Service profile QoS
Server Equipment Administrator
Server Security Administrator
Service profile compute
Service profile configuration
Server Compute Administrator
Server Profile Administrator
Service profile configuration policy Server Profile Administrator
Server Profile Administrator
Network Administrator
Network Administrator
Network Administrator service-profile-qos-policy service-profile-security service-profile-security-policy service-profile-server service-profile-server-oper service-profile-server-policy service-profile-storage
Service profile QoS policy
Service profile security
Service profile security policy
Service profile pool policy
Service profile storage
Network Administrator
Server Security Administrator
Server Security Administrator
Service profile server management Server Profile Administrator
Service profile consumer Server Profile Administrator
Server Security Administrator
Storage Administrator
Cisco UCS Manager CLI Configuration Guide, Release 2.2
185
Configuring Role-Based Access Control
User Locales
Privilege
service-profile-storage-policy
Description
Service profile storage policy
Default Role Assignment
Storage Administrator
User Locales
You can assign a user to one or more locales. Each locale defines one or more organizations (domains) to which a user can access. Access is usually limited to the organizations specified in the locale. An exception is a locale without any organizations. It provides unrestricted access to system resources in all organizations.
A Cisco UCS domain can contain up to 48 user locales. Any user locales configured after the first 48 are accepted, but are inactive with faults raised.
Users with admin or aaa privileges can assign organizations to the locale of other users. The assignment of organizations is restricted to only those in the locale of the user assigning the organizations. For example, if a locale contains only the Engineering organization, a user assigned to that locale can only assign the
Engineering organization to other users.
Note
You cannot assign a locale to users with one or more of the following privileges:
• aaa
• admin
• fault
• operations
You can hierarchically manage organizations. A user who is assigned to a top-level organization has automatic access to all organizations below it. For example, an Engineering organization can contain a Software
Engineering organization and a Hardware Engineering organization. A locale containing only the Software
Engineering organization has access to system resources only within that organization. However, a locale that contains the Engineering organization has access to the resources for both the Software Engineering and
Hardware Engineering organizations.
Configuring User Roles
Creating a User Role
Procedure
Step 1
Command or Action
UCS-A# scope security
Purpose
Enters security mode.
186
Cisco UCS Manager CLI Configuration Guide, Release 2.2
Configuring Role-Based Access Control
Adding Privileges to a User Role
Step 2
Step 3
Step 4
Command or Action Purpose
UCS-A /security # create role name Creates the user role and enters security role mode.
UCS-A /security/role # add privilege
privilege-name
Adds one or more privileges to the role.
Note
You can specify more than one privilege-name on the same command line to add multiple privileges to the role, or you can add privileges to the same role using multiple add commands.
UCS-A /security/role #
commit-buffer
Commits the transaction to the system configuration.
The following example creates the service-profile-security-admin role, adds the service profile security and service profile security policy privileges to the role, and commits the transaction:
UCS-A#
scope security
UCS-A /security #
create role ls-security-admin
UCS-A /security/role* #
add privilege service-profile-security service-profile-security-policy
UCS-A /security/role* #
commit-buffer
UCS-A /security/role #
Adding Privileges to a User Role
Procedure
Step 1
Step 2
Step 3
Step 4
Command or Action
UCS-A# scope security
Purpose
Enters security mode.
UCS-A /security # scope role name Enters security role mode for the specified role.
UCS-A /security/role # add
privilege privilege-name
UCS-A /security/role #
commit-buffer
Adds one or more privileges to the existing privileges of the user role.
Note
You can specify more than one privilege-name on the same command line to add multiple privileges to the role, or you can add privileges to the same role using multiple add privilege commands.
Commits the transaction to the system configuration.
The following example shows how to add the server security and server policy privileges to the service-profile-security-admin role and commit the transaction:
UCS-A#
scope security
UCS-A /security #
scope role service-profile-security-admin
UCS-A /security/role #
add privilege server-security server-policy
Cisco UCS Manager CLI Configuration Guide, Release 2.2
187
Configuring Role-Based Access Control
Replacing Privileges for a User Role
UCS-A /security/role* #
commit-buffer
UCS-A /security/role #
Replacing Privileges for a User Role
Procedure
Step 1
Step 2
Step 3
Step 4
Command or Action
UCS-A# scope security
Purpose
Enters security mode.
UCS-A /security # scope role name Enters security role mode for the specified role.
UCS-A /security/role # set privilege
privilege-name
Replaces the existing privileges of the user role.
Note
You can specify more than one privilege-name on the same command line to replace the existing privilege with multiple privileges. After replacing the privileges, you can add privileges to the same role using the add privilege command.
UCS-A /security/role #
commit-buffer
Commits the transaction to the system configuration.
The following example shows how to replace the existing privileges for the service-profile-security-admin role with the server security and server policy privileges and commit the transaction:
UCS-A#
scope security
UCS-A /security #
scope role service-profile-security-admin
UCS-A /security/role #
set privilege server-security server-policy
UCS-A /security/role* #
commit-buffer
UCS-A /security/role #
Removing Privileges from a User Role
Procedure
Step 1
Step 2
Step 3
Command or Action
UCS-A# scope security
Purpose
Enters security mode.
UCS-A /security # scope role name Enters security role mode for the specified role.
UCS-A /security/role # remove
privilege privilege-name
Removes one or more privileges from the existing user role privileges.
Note
You can specify more than one privilege-name on the same command line to remove multiple privileges from the role, or you can remove privileges from the same role using multiple
remove privilege commands.
188
Cisco UCS Manager CLI Configuration Guide, Release 2.2
Configuring Role-Based Access Control
Deleting a User Role
Step 4
Command or Action
UCS-A /security/role #
commit-buffer
Purpose
Commits the transaction to the system configuration.
The following example removes the server security and server policy privileges from the service-profile-security-admin role and commits the transaction:
UCS-A#
scope security
UCS-A /security #
scope role service-profile-security-admin
UCS-A /security/role #
remove privilege server-security server-policy
UCS-A /security/role* #
commit-buffer
UCS-A /security/role #
Deleting a User Role
Procedure
Step 1
Step 2
Step 3
Command or Action
UCS-A# scope security
UCS-A /security # delete role name
UCS-A /security # commit-buffer
Purpose
Enters security mode.
Deletes the user role.
Commits the transaction to the system configuration.
The following example deletes the service-profile-security-admin role and commits the transaction:
UCS-A#
scope security
UCS-A /security #
delete role service-profile-security-admin
UCS-A /security* #
commit-buffer
UCS-A /security #
Configuring Locales
Creating a Locale
Procedure
Step 1
Step 2
Command or Action
UCS-A# scope security
UCS-A /security # create locale
locale-name
Purpose
Enters security mode.
Creates a locale and enters security locale mode.
Cisco UCS Manager CLI Configuration Guide, Release 2.2
189
Configuring Role-Based Access Control
Assigning an Organization to a Locale
Step 3
Step 4
Command or Action Purpose
UCS-A /security/locale # create org-ref
org-ref-name orgdn orgdn
org-root/org-ref-name
References (binds) an organization to the locale. The
org-ref-name argument is the name used to identify the organization reference, and the orgdn-name argument is the distinguished name of the organization being referenced.
UCS-A /security/locale # commit-buffer Commits the transaction to the system configuration.
The following example creates the western locale, references the finance organization to the locale, names the reference finance-ref, and commits the transaction:
UCS-A#
scope security
UCS-A /security #
create locale western
UCS-A /security/locale* #
create org-ref finance-ref orgdn org-root/org-finance
UCS-A /security/locale* #
commit-buffer
UCS-A /security/locale #
Assigning an Organization to a Locale
Procedure
Step 1
Step 2
Step 3
Step 4
Command or Action
UCS-A# scope security
UCS-A# scope locale locale-name
Purpose
Enters security mode.
Enters security locale mode.
UCS-A /security/locale # create org-ref
org-ref-name orgdn
org-root/org-ref-name
References (binds) an organization to the locale. The
org-ref-name argument is the name used to identify the organization reference, and the orgdn-name argument is the distinguished name of the organization being referenced.
UCS-A /security/locale # commit-buffer Commits the transaction to the system configuration.
The following example enters the western locale, adds (references) the marketing organization to the locale, names the reference marketing-ref, and commits the transaction:
UCS-A#
scope security
UCS-A /security #
scope locale western
UCS-A /security/locale* #
create org-ref marketing-ref orgdn org-root/org-marketing
UCS-A /security/locale* #
commit-buffer
UCS-A /security/locale #
190
Cisco UCS Manager CLI Configuration Guide, Release 2.2
Configuring Role-Based Access Control
Deleting an Organization from a Locale
Deleting an Organization from a Locale
Procedure
Step 1
Step 2
Step 3
Step 4
Command or Action
UCS-A# scope security
Purpose
Enters security mode.
UCS-A /security # scope locale locale-name Enters security locale mode.
UCS-A /security/locale # delete org-ref
org-ref-name
UCS-A /security/locale # commit-buffer
Deletes the organization from the locale.
Commits the transaction to the system configuration.
The following example deletes the finance organization from the western locale and commits the transaction:
UCS-A#
scope security
UCS-A /security #
scope locale western
UCS-A /security/locale #
delete org-ref finance-ref
UCS-A /security/locale* #
commit-buffer
UCS-A /security/locale #
Deleting a Locale
Procedure
Step 1
Step 2
Step 3
Command or Action
UCS-A# scope security
Purpose
Enters security mode.
UCS-A /security # delete locale locale-name Deletes the locale.
UCS-A /security # commit-buffer Commits the transaction to the system configuration.
The following example deletes the western locale and commits the transaction:
UCS-A#
scope security
UCS-A /security #
delete locale western
UCS-A /security* #
commit-buffer
UCS-A /security #
Cisco UCS Manager CLI Configuration Guide, Release 2.2
191
Configuring Role-Based Access Control
Configuring Locally Authenticated User Accounts
Configuring Locally Authenticated User Accounts
Creating a User Account
At a minimum, Cisco recommends that you create the following users:
• Server administrator account
• Network administrator account
• Storage administrator
Before You Begin
Perform the following tasks, if the system includes any of the following:
• Remote authentication services—Ensures that the users exist in the remote authentication server with the appropriate roles and privileges.
• Multitenancy with organizations—Creates one or more locales. If you do not have any locales, all users are created in root and are assigned roles and privileges in all organizations.
• SSH authentication—Obtains the SSH key.
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Command or Action
UCS-A# scope security
UCS-A /security # create local-user
local-user-name
UCS-A /security/local-user # set
account-status {active| inactive}
Purpose
Enters security mode.
Creates a user account for the specified local user and enters security local user mode.
Specifies whether the local user account is enabled or disabled.
If the account status for a local user account is set to inactive, the user is prevented from logging into the system using their existing credentials.
Sets the password for the user account UCS-A /security/local-user # set
password password
UCS-A /security/local-user # set
firstname first-name
UCS-A /security/local-user # set
lastname last-name
UCS-A /security/local-user # set
expiration month day-of-month year
(Optional)
Specifies the first name of the user.
(Optional)
Specifies the last name of the user.
(Optional)
Specifies the date that the user account expires. The
month argument is the first three letters of the month name.
192
Cisco UCS Manager CLI Configuration Guide, Release 2.2
Configuring Role-Based Access Control
Creating a User Account
Step 8
Step 9
Step 10
Step 11
Command or Action Purpose
Note
After you configure a user account with an expiration date, you cannot reconfigure the account to not expire. However, you can configure the account to use the latest expiration date available.
UCS-A /security/local-user # set email
email-addr
(Optional)
Specifies the user e-mail address.
UCS-A /security/local-user # set phone
phone-num
(Optional)
Specifies the user phone number.
UCS-A /security/local-user # set sshkey
ssh-key
(Optional)
Specifies the SSH key used for passwordless access.
UCS-A security/local-user #
commit-buffer
Commits the transaction.
The following example creates the user account named kikipopo, enables the user account, sets the password to foo12345, and commits the transaction:
UCS-A#
scope security
UCS-A /security #
create local-user kikipopo
UCS-A /security/local-user* #
set account-status active
UCS-A /security/local-user* #
set password
Enter a password:
Confirm the password:
UCS-A /security/local-user* #
commit-buffer
UCS-A /security/local-user #
The following example creates the user account named lincey, enables the user account, sets an OpenSSH key for passwordless access, and commits the transaction.
UCS-A#
scope security
UCS-A /security #
create local-user lincey
UCS-A /security/local-user* #
set account-status active
UCS-A /security/local-user* #
set sshkey "ssh-rsa
AAAAB3NzaC1yc2EAAAABIwAAAIEAuo9VQ2CmWBI9/S1f30klCWjnV3lgdXMzO0WUl5iPw85lkdQqap+NFuNmHcb4K iaQB8X/PDdmtlxQQcawclj+k8f4VcOelBxlsGk5luq5ls1ob1VOIEwcKEL/h5lrdbNlI8y3SS9I/gGiBZ9ARlop9LDpD m8HPh2LOgyH7Ei1MI8="
UCS-A /security/local-user* #
commit-buffer
UCS-A /security/local-user #
The following example creates the user account named jforlenz, enables the user account, sets a Secure SSH key for passwordless access, and commits the transaction.
UCS-A#
scope security
UCS-A /security #
create local-user jforlenz
UCS-A /security/local-user* #
set account-status active
UCS-A /security/local-user* #
set sshkey
Enter lines one at a time. Enter ENDOFBUF to finish. Press ^C to abort.
User's SSH key:
>
---- BEGIN SSH2 PUBLIC KEY ----
>
AAAAB3NzaC1yc2EAAAABIwAAAIEAuo9VQ2CmWBI9/S1f30klCWjnV3lgdXMzO0WUl5iPw8
>
5lkdQqap+NFuNmHcb4KiaQB8X/PDdmtlxQQcawclj+k8f4VcOelBxlsGk5luq5ls1ob1VO
>
IEwcKEL/h5lrdbNlI8y3SS9I/gGiBZ9ARlop9LDpDm8HPh2LOgyH7Ei1MI8=
>
---- END SSH2 PUBLIC KEY ----
>
ENDOFBUF
UCS-A /security/local-user* #
commit-buffer
UCS-A /security/local-user #
Cisco UCS Manager CLI Configuration Guide, Release 2.2
193
Configuring Role-Based Access Control
Enabling the Password Strength Check for Locally Authenticated Users
Enabling the Password Strength Check for Locally Authenticated Users
You must have admin or aaa privileges to enable the password strength check. If enabled, Cisco UCS Manager does not permit a user to choose a password that does not meet the guidelines for a strong password.
Procedure
Step 1
Step 2
Command or Action
UCS-A# scope security
Purpose
Enters security mode.
UCS-A /security # enforce-strong-password
{yes | no}
Specifies whether the password strength check is enabled or disabled.
The following example enables the password strength check:
UCS-A#
scope security
UCS-A /security #
set enforce-strong-password yes
UCS-A /security #
Setting Web Session Limits for User Accounts
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Command or Action
UCS-A# scope system
Purpose
Enters system mode.
UCS-A /system # scope services Enters system services mode.
UCS-A /system/services # scope
web-session-limits
Enters system services web session limits mode.
UCS-A /system/services/web-session-limits
# set peruser num-of-logins-per-user
Sets the maximum number of concurrent HTTP and HTTPS sessions allowed for each user.
Enter an integer between 1 and 256. By default, this value is set to 32.
UCS-A /system/services/web-session-limits
# commit-buffer
Commits the transaction to the system configuration.
The following example sets the maximum number of HTTP and HTTPS sessions allowed by each user account to 60 and commits the transaction:
UCS-A#
scope system
UCS-A /system #
scope services
UCS-A /system/services #
scope web-session-limits
UCS-A /system/services/web-session-limits* #
set peruser 60
UCS-A /system/services/web-session-limits* #
commit-buffer
UCS-A /system/services/web-session-limits #
194
Cisco UCS Manager CLI Configuration Guide, Release 2.2
Configuring Role-Based Access Control
Assigning a Role to a User Account
Assigning a Role to a User Account
Changes in user roles and privileges do not take effect until the next time the user logs in. If a user is logged in when you assign a new role to or remove an existing role from a user account, the active session continues with the previous roles and privileges.
Procedure
Step 1
Step 2
Step 3
Step 4
Command or Action
UCS-A# scope security
UCS-A /security # scope local-user
local-user-name
Purpose
Enters security mode.
Enters security local user mode for the specified local user account.
UCS-A /security/local-user # create role
role-name
Assigns the specified role to the user account .
Note
The create role command can be entered multiple times to assign more than one role to a user account.
UCS-A security/local-user #
commit-buffer
Commits the transaction.
The following example assigns the operations role to the kikipopo local user account and commits the transaction:
UCS-A#
scope security
UCS-A /security #
scope local-user kikipopo
UCS-A /security/local-user #
create role operations
UCS-A /security/local-user* #
commit-buffer
UCS-A /security/local-user #
Assigning a Locale to a User Account
Note
Do not assign locales to users with an admin or aaa role.
Procedure
Step 1
Step 2
Step 3
Command or Action
UCS-A# scope security
UCS-A /security # scope local-user
local-user-name
UCS-A /security/local-user # create
locale locale-name
Purpose
Enters security mode.
Enters security local user mode for the specified local user account.
Assigns the specified locale to the user account.
Cisco UCS Manager CLI Configuration Guide, Release 2.2
195
Configuring Role-Based Access Control
Removing a Role from a User Account
Command or Action Purpose
Note
The create locale command can be entered multiple times to assign more than one locale to a user account.
Commits the transaction.
Step 4
UCS-A security/local-user #
commit-buffer
The following example assigns the western locale to the kikipopo local user account and commits the transaction:
UCS-A#
scope security
UCS-A /security #
scope local-user kikipopo
UCS-A /security/local-user #
create locale western
UCS-A /security/local-user* #
commit-buffer
UCS-A /security/local-user #
Removing a Role from a User Account
Changes in user roles and privileges do not take effect until the next time the user logs in. If a user is logged in when you assign a new role to or remove an existing role from a user account, the active session continues with the previous roles and privileges.
Procedure
Step 1
Step 2
Step 3
Step 4
Command or Action
UCS-A# scope security
UCS-A /security # scope local-user
local-user-name
Purpose
Enters security mode.
Enters security local user mode for the specified local user account.
UCS-A /security/local-user # delete role
role-name
.
Removes the specified role from the user account
Note
The delete role command can be entered multiple times to remove more than one role from a user account.
UCS-A security/local-user #
commit-buffer
Commits the transaction.
The following example removes the operations role from the kikipopo local user account and commits the transaction:
UCS-A#
scope security
UCS-A /security #
scope local-user kikipopo
UCS-A /security/local-user #
delete role operations
UCS-A /security/local-user* #
commit-buffer
UCS-A /security/local-user #
196
Cisco UCS Manager CLI Configuration Guide, Release 2.2
Configuring Role-Based Access Control
Removing a Locale from a User Account
Removing a Locale from a User Account
Procedure
Step 1
Step 2
Step 3
Command or Action
UCS-A# scope security
UCS-A /security # scope local-user
local-user-name
UCS-A /security/local-user # delete
locale locale-name
Step 4
UCS-A security/local-user #
commit-buffer
Purpose
Enters security mode.
Enters security local user mode for the specified local user account.
Removes the specified locale from the user account.
Note
The delete locale command can be entered multiple times to remove more than one locale from a user account.
Commits the transaction.
The following example removes the western locale from the kikipopo local user account and commits the transaction:
UCS-A#
scope security
UCS-A /security #
scope local-user kikipopo
UCS-A /security/local-user #
delete locale western
UCS-A /security/local-user* #
commit-buffer
UCS-A /security/local-user #
Enabling or Disabling a User Account
You must have admin or aaa privileges to enable or disable a local user account.
Before You Begin
Create a local user account.
Procedure
Step 1
Step 2
Step 3
Command or Action
UCS-A# scope security
Purpose
Enters security mode.
UCS-A /security # scope local-user Enters local-user security mode.
UCS-A /security/local-user # set
account-status {active | inactive}
Specifies whether the local user account is enabled or disabled.
The admin user account is always set to active. It cannot be modified.
Note
If you set the account status to inactive, the configuration is not deleted from the database.
Cisco UCS Manager CLI Configuration Guide, Release 2.2
197
Configuring Role-Based Access Control
Clearing the Password History for a Locally Authenticated User
Command or Action Purpose
The following example enables a local user account called accounting:
UCS-A#
scope security
UCS-A /security #
scope local-user accounting
UCS-A /security/local-user #
set account-status active
Clearing the Password History for a Locally Authenticated User
Procedure
Step 1
Step 2
Step 3
Step 4
Command or Action
UCS-A# scope security
UCS-A /security # scope local-user
user-name
UCS-A /security/local-user # set clear
password-history yes
Purpose
Enters security mode.
Enters local user security mode for the specified user account.
Clears the password history for the specified user account.
UCS-A /security/local-user # commit-buffer Commits the transaction to the system configuration.
The following example configures the password history count and commits the transaction:
UCS-A #
scope security
UCS-A /security #
scope local-user admin
UCS-A /security/local-user #
set clear password-history yes
UCS-A /security/local-user* #
commit-buffer
UCS-A /security/local-user #
Deleting a User Account
Procedure
Step 1
Step 2
Step 3
Command or Action
UCS-A# scope security
UCS-A /security # delete local-user
local-user-name
UCS-A /security # commit-buffer
Purpose
Enters security mode.
Deletes the local-user account.
Commits the transaction to the system configuration.
198
Cisco UCS Manager CLI Configuration Guide, Release 2.2
Configuring Role-Based Access Control
Password Profile for Locally Authenticated Users
The following example deletes the foo user account and commits the transaction:
UCS-A#
scope security
UCS-A /security #
delete local-user foo
UCS-A /security* #
commit-buffer
UCS-A /security #
Password Profile for Locally Authenticated Users
The password profile contains the password history and the password change interval properties for all locally authenticated users of Cisco UCS Manager. You cannot specify a different password profile for locally authenticated users.
Note
You must have admin or aaa privileges to change the password profile properties. Except for password history, these properties do not apply to users with admin or aaa privileges.
Password History Count
The password history count prevents locally authenticated users from reusing the same password. When you configure the password history count, Cisco UCS Manager stores up to a maximum of 15 previously used passwords. The password history count stores the passwords in reverse chronological order with the most recent password first. This ensures that the user can only reuse the oldest password when the history count reaches its threshold.
A user can create and use the number of passwords configured in the password history count before reusing a password. For example, if you set the password history count to 8, a user cannot reuse the first password until the ninth password expires.
By default, the password history is set to 0. This value disables the history count and allows users to reuse previously used passwords at any time.
You can clear the password history count for a locally authenticated user and enable reuse of previous passwords.
Password Change Interval
The password change interval restricts the number of password changes that a locally authenticated user can make within a specific number of hours. The following table describes the two interval configuration options for the password change interval.
Interval Configuration
No password change allowed
Description Example
Does not allow changing passwords for locally authenticated user within a specified number of hours after a password change.
To prevent the user from changing passwords within 48 hours after a password change:
You can specify a no change interval between 1 and 745 hours. By default, the no change interval is 24 hours.
• Set Change during interval to disable
• Set No change interval to 48
Cisco UCS Manager CLI Configuration Guide, Release 2.2
199
Configuring Role-Based Access Control
Configuring the Maximum Number of Password Changes for a Change Interval
Interval Configuration
Password changes allowed within change interval
Description Example
Specifies the maximum number of times that a locally authenticated user password change can occur within a pre-defined interval.
You can specify a change interval between 1 and 745 hours and a maximum number of password changes between 0 and 10. By default, a locally authenticated user is permitted a maximum of two password changes within a 48-hour interval.
To allow a password change for a maximum of one time within 24 hours after a password change:
• Set Change during interval to enable
• Set Change count to 1
• Set Change interval to 24
Configuring the Maximum Number of Password Changes for a Change Interval
You must have admin or aaa privileges to change the password profile properties. Except for password history, these properties do not apply to users with admin or aaa privileges.
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Command or Action
UCS-A# scope security
Purpose
Enters security mode.
UCS-A /security # scope
password-profile
UCS-A /security/password-profile #
set change-during-interval enable
Enters password profile security mode.
Restricts the number of password changes a locally authenticated user can make within a given number of hours.
UCS-A /security/password-profile #
set change-count pass-change-num
Specifies the maximum number of times a locally authenticated user can change his or her password during the Change Interval.
This value can be anywhere from 0 to 10.
UCS-A /security/password-profile #
set change-interval num-of-hours
Specifies the maximum number of hours over which the number of password changes specified in the Change
Count field are enforced.
This value can be anywhere from 1 to 745 hours.
For example, if this field is set to 48 and the Change
Count field is set to 2, a locally authenticated user can make no more than 2 password changes within a 48 hour period.
UCS-A /security/password-profile #
commit-buffer
Commits the transaction to the system configuration.
200
Cisco UCS Manager CLI Configuration Guide, Release 2.2
Configuring Role-Based Access Control
Configuring a No Change Interval for Passwords
The following example enables the change during interval option, sets the change count to 5, sets the change interval to 72 hours, and commits the transaction:
UCS-A #
scope security
UCS-A /security #
scope password-profile
UCS-A /security/password-profile #
set change-during-interval enable
UCS-A /security/password-profile* #
set change-count 5
UCS-A /security/password-profile* #
set change-interval 72
UCS-A /security/password-profile* #
commit-buffer
UCS-A /security/password-profile #
Configuring a No Change Interval for Passwords
You must have admin or aaa privileges to change the password profile properties. Except for password history, these properties do not apply to users with admin or aaa privileges.
Procedure
Step 1
Step 2
Step 3
Step 4
Step 5
Command or Action
UCS-A# scope security
Purpose
Enters security mode.
UCS-A /security # scope
password-profile
UCS-A /security/password-profile # set
change-during-interval disable
UCS-A /security/password-profile # set
no-change-interval min-num-hours
Enters password profile security mode.
Disables the change during interval feature.
Specifies the minimum number of hours that a locally authenticated user must wait before changing a newly created password.
This value can be anywhere from 1 to 745 hours.
This interval is ignored if the Change During
Interval property is set to Disable.
UCS-A /security/password-profile #
commit-buffer
Commits the transaction to the system configuration.
The following example disables the change during interval option, sets the no change interval to 72 hours, and commits the transaction:
UCS-A #
scope security
UCS-A /security #
scope password-profile
UCS-A /security/password-profile #
set change-during-interval disable
UCS-A /security/password-profile* #
set no-change-interval 72
UCS-A /security/password-profile* #
commit-buffer
UCS-A /security/password-profile #
Configuring the Password History Count
You must have admin or aaa privileges to change the password profile properties.
Cisco UCS Manager CLI Configuration Guide, Release 2.2
201
Configuring Role-Based Access Control
Monitoring User Sessions from the CLI
Procedure
Step 1
Step 2
Step 3
Step 4
Command or Action
UCS-A# scope security
Purpose
Enters security mode.
UCS-A /security # scope
password-profile
Enters password profile security mode.
UCS-A /security/password-profile #
set history-count num-of-passwords
Specifies the number of unique passwords that a locally authenticated user must create before that user can reuse a previously used password
This value can be anywhere from 0 to 15.
By default, the History Count field is set to 0, which disables the history count and allows users to reuse previously used passwords at any time.
UCS-A /security/password-profile #
commit-buffer
Commits the transaction to the system configuration.
The following example configures the password history count and commits the transaction:
UCS-A #
scope security
UCS-A /security #
scope password-profile
UCS-A /security/password-profile #
set history-count 5
UCS-A /security/password-profile* #
commit-buffer
UCS-A /security/password-profile #
Monitoring User Sessions from the CLI
Procedure
Step 1
Step 2
Command or Action
UCS-A# scope security
UCS-A /security # show user-session
{local | remote} [detail]
Purpose
Enters security mode.
Displays session information for all users logged in to the system. An asterisk (*) next to the session ID denotes the current login session.
The following example lists all local users logged in to the system. The asterisk indicates which session is the current login session.
UCS-A#
scope security
UCS-A /security #
show user-session local
Session Id User Host Login Time
--------------- --------------- -------------------- ---------pts_25_1_31264* steve ttyS0_1_3532 jeff web_25277_A faye
192.168.100.111
console
192.168.100.112
2009-05-09T14:06:59
2009-05-02T15:11:08
2009-05-15T22:11:25
202
Cisco UCS Manager CLI Configuration Guide, Release 2.2
Configuring Role-Based Access Control
Monitoring User Sessions from the CLI
The following example displays detailed information on all local users logged in to the system:
UCS-A#
scope security
UCS-A /security #
show user-session local detail
Session Id pts_25_1_31264:
Fabric Id: A
Term: pts/25
User: steve
Host: 64.101.53.93
Pid: 31264
Login Time: 2009-05-09T14:06:59
Session Id ttyS0_1_3532:
Fabric Id: A
Term: ttyS0
User: jeff
Host: console
Pid: 3532
Login Time: 2009-05-02T15:11:08
Session Id web_25277_A:
Fabric Id: A
Term: web_25277
User: faye
Host: 192.168.100.112
Pid: 3518
Login Time: 2009-05-15T22:11:25
Cisco UCS Manager CLI Configuration Guide, Release 2.2
203
Monitoring User Sessions from the CLI
Configuring Role-Based Access Control
204
Cisco UCS Manager CLI Configuration Guide, Release 2.2
ดาวน์โหลด
ลิงก์สาธารณะได้รับการอัปเดตแล้ว
ลิงก์สาธารณะไปยังแชทของคุณได้รับการอัปเดตแล้ว You may view and manage your chat links after registration here.
ลิงก์สาธารณะของเอกสาร
โฆษณา