Check Levels

This scenario shows how to configure different user-levels for operational commands.

Lower Command User Level

Description

This example demonstrates how to lower the permissions needed to execute a specific operational command.

Scenario

Step 1: Set the following configuration in DUT0:

set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user teldat authentication encrypted-password '$6$i0G1.tfNPyQjKpPA$gyAB8LL.5L7MHn1dmJfhSW/Lbc/OZH0An7gNCRho5JrqwWjWHaDTfU0iQ3.U14hhIgWayB.UuVEbnTbWXlZTU.'
set system login user teldat role monitor

Step 2: Run command show running at DUT0 and check if output contains the following tokens:

Insufficient privileges

Step 3: Login as admin user on {‘DOC’: ‘SDE’, ‘CAPS’: ‘all -cellular -ceetm’, ‘FWID’: ‘iso’, ‘VENDOR’: ‘Teldat’, ‘LICENSE’: ‘VM’, ‘ETH0’: ‘eth0’, ‘ETH1’: ‘eth1’, ‘CPUS’: ‘4’, ‘MEM’: ‘2049’, ‘CMD_TIMEOUT’: ’20s’, ‘REBOOT_TIMEOUT’: ‘300s’, ‘UPDATE_TIMEOUT’: ‘600s’, ‘COMMIT_TIMEOUT’: ’60s’, ‘PORT’: 4000, ‘ALIAS’: ‘DUT0’, ‘HDA’: ‘/var/tmp/hd-vm0.img’, ‘MON_PORT’: 5000, ‘MON_ALIAS’: ‘VM0_MON’, ‘ETH0_MAC’: ‘DE:AD:BE:EF:6C:00’, ‘ETH1_MAC’: ‘DE:AD:BE:EF:6C:01’, ‘FW_NAME’: ‘os_iso.iso’, ‘ROBOT_IP’: ‘10.215.168.64’, ‘NEEDS_REBOOT’: False, ‘NEEDS_LICENSE’: True}.

Step 4: Modify the following configuration lines in DUT0:

set user-level 0 command 'show running'

Step 5: Run command show running at DUT0 and expect this output:

Step 6: Login as admin user on {‘DOC’: ‘SDE’, ‘CAPS’: ‘all -cellular -ceetm’, ‘FWID’: ‘iso’, ‘VENDOR’: ‘Teldat’, ‘LICENSE’: ‘VM’, ‘ETH0’: ‘eth0’, ‘ETH1’: ‘eth1’, ‘CPUS’: ‘4’, ‘MEM’: ‘2049’, ‘CMD_TIMEOUT’: ’20s’, ‘REBOOT_TIMEOUT’: ‘300s’, ‘UPDATE_TIMEOUT’: ‘600s’, ‘COMMIT_TIMEOUT’: ’60s’, ‘PORT’: 4000, ‘ALIAS’: ‘DUT0’, ‘HDA’: ‘/var/tmp/hd-vm0.img’, ‘MON_PORT’: 5000, ‘MON_ALIAS’: ‘VM0_MON’, ‘ETH0_MAC’: ‘DE:AD:BE:EF:6C:00’, ‘ETH1_MAC’: ‘DE:AD:BE:EF:6C:01’, ‘FW_NAME’: ‘os_iso.iso’, ‘ROBOT_IP’: ‘10.215.168.64’, ‘NEEDS_REBOOT’: False, ‘NEEDS_LICENSE’: True}.

Raise Command User Level

Description

This example demonstrates how to raise the permissions needed to execute a specific operational command.

Scenario

Step 1: Set the following configuration in DUT0:

set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user teldat authentication encrypted-password '$6$EPIaq2HGKW2.2eb5$n0csKHhjaUJxlq66WkN/tyHVgJPui4Uibb8Iud5gWnUKenwwIigDx.WCg1TCn2m3wmKoKaTSE/A99Vhmfwj4j1'
set system login user teldat role monitor

Step 2: Run command system login show users at DUT0 and expect this output:

Step 3: Login as admin user on {‘DOC’: ‘SDE’, ‘CAPS’: ‘all -cellular -ceetm’, ‘FWID’: ‘iso’, ‘VENDOR’: ‘Teldat’, ‘LICENSE’: ‘VM’, ‘ETH0’: ‘eth0’, ‘ETH1’: ‘eth1’, ‘CPUS’: ‘4’, ‘MEM’: ‘2049’, ‘CMD_TIMEOUT’: ’20s’, ‘REBOOT_TIMEOUT’: ‘300s’, ‘UPDATE_TIMEOUT’: ‘600s’, ‘COMMIT_TIMEOUT’: ’60s’, ‘PORT’: 4000, ‘ALIAS’: ‘DUT0’, ‘HDA’: ‘/var/tmp/hd-vm0.img’, ‘MON_PORT’: 5000, ‘MON_ALIAS’: ‘VM0_MON’, ‘ETH0_MAC’: ‘DE:AD:BE:EF:6C:00’, ‘ETH1_MAC’: ‘DE:AD:BE:EF:6C:01’, ‘FW_NAME’: ‘os_iso.iso’, ‘ROBOT_IP’: ‘10.215.168.64’, ‘NEEDS_REBOOT’: False, ‘NEEDS_LICENSE’: True}.

Step 4: Modify the following configuration lines in DUT0:

set user-level 15 command 'system login show users'

Step 5: Run command show running at DUT0 and check if output contains the following tokens:

Insufficient privileges

Step 6: Login as admin user on {‘DOC’: ‘SDE’, ‘CAPS’: ‘all -cellular -ceetm’, ‘FWID’: ‘iso’, ‘VENDOR’: ‘Teldat’, ‘LICENSE’: ‘VM’, ‘ETH0’: ‘eth0’, ‘ETH1’: ‘eth1’, ‘CPUS’: ‘4’, ‘MEM’: ‘2049’, ‘CMD_TIMEOUT’: ’20s’, ‘REBOOT_TIMEOUT’: ‘300s’, ‘UPDATE_TIMEOUT’: ‘600s’, ‘COMMIT_TIMEOUT’: ’60s’, ‘PORT’: 4000, ‘ALIAS’: ‘DUT0’, ‘HDA’: ‘/var/tmp/hd-vm0.img’, ‘MON_PORT’: 5000, ‘MON_ALIAS’: ‘VM0_MON’, ‘ETH0_MAC’: ‘DE:AD:BE:EF:6C:00’, ‘ETH1_MAC’: ‘DE:AD:BE:EF:6C:01’, ‘FW_NAME’: ‘os_iso.iso’, ‘ROBOT_IP’: ‘10.215.168.64’, ‘NEEDS_REBOOT’: False, ‘NEEDS_LICENSE’: True}.

Customize Multi-option Command

Description

This example demonstrates how to prohibit the use of some options in a specific operational command.

Scenario

Step 1: Set the following configuration in DUT0:

set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user teldat authentication encrypted-password '$6$8/M9G27GeV7R5caj$MR/zVhqJZ.WRTSnfgmXE/s1tGmFMNWNwSIDOnp3m0D848YzjPeNhhwcRezGyCaGBf1r0LyNprEVtyugeTxii30'
set system login user teldat role monitor

Step 2: Run command system conntrack show protocol tcp at DUT0 and expect this output:

Step 3: Login as admin user on {‘DOC’: ‘SDE’, ‘CAPS’: ‘all -cellular -ceetm’, ‘FWID’: ‘iso’, ‘VENDOR’: ‘Teldat’, ‘LICENSE’: ‘VM’, ‘ETH0’: ‘eth0’, ‘ETH1’: ‘eth1’, ‘CPUS’: ‘4’, ‘MEM’: ‘2049’, ‘CMD_TIMEOUT’: ’20s’, ‘REBOOT_TIMEOUT’: ‘300s’, ‘UPDATE_TIMEOUT’: ‘600s’, ‘COMMIT_TIMEOUT’: ’60s’, ‘PORT’: 4000, ‘ALIAS’: ‘DUT0’, ‘HDA’: ‘/var/tmp/hd-vm0.img’, ‘MON_PORT’: 5000, ‘MON_ALIAS’: ‘VM0_MON’, ‘ETH0_MAC’: ‘DE:AD:BE:EF:6C:00’, ‘ETH1_MAC’: ‘DE:AD:BE:EF:6C:01’, ‘FW_NAME’: ‘os_iso.iso’, ‘ROBOT_IP’: ‘10.215.168.64’, ‘NEEDS_REBOOT’: False, ‘NEEDS_LICENSE’: True}.

Step 4: Modify the following configuration lines in DUT0:

set user-level 15 command 'system conntrack show protocol <txt>'

Step 5: Run command system conntrack show protocol tcp at DUT0 and check if output contains the following tokens:

Insufficient privileges

Step 6: Login as admin user on {‘DOC’: ‘SDE’, ‘CAPS’: ‘all -cellular -ceetm’, ‘FWID’: ‘iso’, ‘VENDOR’: ‘Teldat’, ‘LICENSE’: ‘VM’, ‘ETH0’: ‘eth0’, ‘ETH1’: ‘eth1’, ‘CPUS’: ‘4’, ‘MEM’: ‘2049’, ‘CMD_TIMEOUT’: ’20s’, ‘REBOOT_TIMEOUT’: ‘300s’, ‘UPDATE_TIMEOUT’: ‘600s’, ‘COMMIT_TIMEOUT’: ’60s’, ‘PORT’: 4000, ‘ALIAS’: ‘DUT0’, ‘HDA’: ‘/var/tmp/hd-vm0.img’, ‘MON_PORT’: 5000, ‘MON_ALIAS’: ‘VM0_MON’, ‘ETH0_MAC’: ‘DE:AD:BE:EF:6C:00’, ‘ETH1_MAC’: ‘DE:AD:BE:EF:6C:01’, ‘FW_NAME’: ‘os_iso.iso’, ‘ROBOT_IP’: ‘10.215.168.64’, ‘NEEDS_REBOOT’: False, ‘NEEDS_LICENSE’: True}.

Customize File Pipe Command

Description

This example demonstrates how to lower the permissions needed to execute both the file pipe and the operational command.

Scenario

Step 1: Set the following configuration in DUT0:

set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
set system login user teldat authentication encrypted-password '$6$azXI9jlHgj2iOa1U$inP5hUP5bsAJoIHXUriKjeDDJ7x7AVSGvztrH.8k9wAfn6diRip4PT9kVGqX1dTPeu/xF3HFW1N.w64tlc322/'
set system login user teldat role monitor

Step 2: Run command system login show users | file at DUT0 and expect this output:

Step 3: Login as admin user on {‘DOC’: ‘SDE’, ‘CAPS’: ‘all -cellular -ceetm’, ‘FWID’: ‘iso’, ‘VENDOR’: ‘Teldat’, ‘LICENSE’: ‘VM’, ‘ETH0’: ‘eth0’, ‘ETH1’: ‘eth1’, ‘CPUS’: ‘4’, ‘MEM’: ‘2049’, ‘CMD_TIMEOUT’: ’20s’, ‘REBOOT_TIMEOUT’: ‘300s’, ‘UPDATE_TIMEOUT’: ‘600s’, ‘COMMIT_TIMEOUT’: ’60s’, ‘PORT’: 4000, ‘ALIAS’: ‘DUT0’, ‘HDA’: ‘/var/tmp/hd-vm0.img’, ‘MON_PORT’: 5000, ‘MON_ALIAS’: ‘VM0_MON’, ‘ETH0_MAC’: ‘DE:AD:BE:EF:6C:00’, ‘ETH1_MAC’: ‘DE:AD:BE:EF:6C:01’, ‘FW_NAME’: ‘os_iso.iso’, ‘ROBOT_IP’: ‘10.215.168.64’, ‘NEEDS_REBOOT’: False, ‘NEEDS_LICENSE’: True}.

Step 4: Modify the following configuration lines in DUT0:

set user-level 10 command file

Step 5: Run command system login show users | file at DUT0 and check if output contains the following tokens:

Insufficient privileges

Step 6: Login as admin user on {‘DOC’: ‘SDE’, ‘CAPS’: ‘all -cellular -ceetm’, ‘FWID’: ‘iso’, ‘VENDOR’: ‘Teldat’, ‘LICENSE’: ‘VM’, ‘ETH0’: ‘eth0’, ‘ETH1’: ‘eth1’, ‘CPUS’: ‘4’, ‘MEM’: ‘2049’, ‘CMD_TIMEOUT’: ’20s’, ‘REBOOT_TIMEOUT’: ‘300s’, ‘UPDATE_TIMEOUT’: ‘600s’, ‘COMMIT_TIMEOUT’: ’60s’, ‘PORT’: 4000, ‘ALIAS’: ‘DUT0’, ‘HDA’: ‘/var/tmp/hd-vm0.img’, ‘MON_PORT’: 5000, ‘MON_ALIAS’: ‘VM0_MON’, ‘ETH0_MAC’: ‘DE:AD:BE:EF:6C:00’, ‘ETH1_MAC’: ‘DE:AD:BE:EF:6C:01’, ‘FW_NAME’: ‘os_iso.iso’, ‘ROBOT_IP’: ‘10.215.168.64’, ‘NEEDS_REBOOT’: False, ‘NEEDS_LICENSE’: True}.