This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>

Enterprise
Community Forums Switches
S5720 security level for ...

S5720 security level for only port control

Created: Jun 29, 2018 13:51:17Latest reply: Aug 9, 2018 06:11:31 1413 11 0 0
  Rewarded Hi-coins： 0 (problem resolved)
display all floors #1
Hello,

I want to create a user for my S5720 Switch with privilegs only that the user can reboot or shut down the normal Gigabit Interface Ports 0/0/1 - 0/0/24.

Is that possible? And max. that the user can read the config or not at all if possible.

How can I do this in cli?

thanks and regards
Flo
  • x
  • convention：

I have this problem too (0) Favorite(0) Share Report
Featured Answers
StarOfWest
Created Aug 9, 2018 06:11:31 Helpful(1) Helpful(1)

You need to do some extra configuration.
1. Define access to system view.
2. define interfaces for which you allow access.
3. define shutdown interface command, but pay attention whether is l2 or l3 interface.
4. define undo shutdown command, i believe you want level 1 user to activate the interface back

command-privilege level 1 view shell system-view
command-privilege level 1 view system interface GigabitEthernet0/0/1
command-privilege level 1 view system interface GigabitEthernet0/0/2
command-privilege level 1 view system interface GigabitEthernet0/0/3
command-privilege level 1 view gigabitethernet shutdown
command-privilege level 1 view gigabitethernet-l2 shutdown
command-privilege level 1 view gigabitethernet undo shutdown
command-privilege level 1 view gigabitethernet-l2 undo shutdown

Cheers
  • x
  • convention：
“We only get answers to the questions that we ask.” physicist Werner Heisenberg
All Answers
Sergio93
Sergio93 Created Jun 29, 2018 14:06:41 Helpful(1) Helpful(1)

Hi Flo,

You can use the command below to add the privilege of shutdown command in interface view for a privilege level of 1 for example. Users with privilege 1 have access only to display commands, but you can add also privilege level for shutdown interface in their their level :
It should be like this :
<HUAWEI> system-view
[HUAWEI] command-privilege level 1 view inteface shutdown

Please try and confirm if this is what you need.
Command reference :
http://support.huawei.com/hedex/hdx.do?docid=EDOC1000135317&id=command-privilege_level&text=command-privilege%252520level&lang=en
  • x
  • convention：
BEST ANSWER! If you think I earn it!
If this post was useful to you, please click the Helpful button and flag my post as a "BEST ANSWER" so others can benefit. Thank you
Sergio93
Sergio93 Created Jun 29, 2018 14:09:53 Helpful(0) Helpful(0)

Posted by Sergio93 at 2018-06-29 14:06 Hi Flo,You can use the command below to add the privilege of shutdown command in interface view for ...
Sorry, it should be like this :
<HUAWEI> system-view
[HUAWEI] command-privilege level 1 view gigabitethernet shutdown
  • x
  • convention：
BEST ANSWER! If you think I earn it!
If this post was useful to you, please click the Helpful button and flag my post as a "BEST ANSWER" so others can benefit. Thank you
andsta
andsta Created Jun 29, 2018 14:10:34 Helpful(0) Helpful(0)

Hello yoface,

Please refer to the following link: http://support.huawei.com/hedex/hdx.do?docid=EDOC1000161579&id=user_privilege&text=user%252520privilege&lang=en

If I understand right you want to restrict the user to only use some commands. You can restrict the user to read the config using user privilege level 1 or 2 ( detailed in the documentation above).
Regarding the reboot and shut down of the interfaces after applying user privilege I hope this document about command-privilege level may help you:
http://support.huawei.com/hedex/pages/EDOC1000161579DEG0801J/04/EDOC1000161579DEG0801J/04/resources/dc/command-privilege_level.html
  • x
  • convention：
yoface
yoface Created Jun 29, 2018 15:15:52 Helpful(0) Helpful(0)

Hi all

thank you for your help, that looks good so far!

When I want to test to shutdown a port with the new created user with privilege level 1 rights and command-privilege level 1 view gigabitethernet shutdown - how is the command to shutdown a port with this account?

I see that I cant do system view or something else. How does that works ?
  • x
  • convention：
Sergio93
Sergio93 Created Jun 29, 2018 16:02:06 Helpful(0) Helpful(0)

Hi Flo,

Normally, an user that have privilege level 1 has access only to the user-view so just to display commands not to system-view. But with that command you change the privilege command structure, in this case you allow the level 1 users to perform shutdown for interfaces. This can be done for other commands too.
Hope this is clear.
  • x
  • convention：
BEST ANSWER! If you think I earn it!
If this post was useful to you, please click the Helpful button and flag my post as a "BEST ANSWER" so others can benefit. Thank you
yoface
yoface Created Jul 5, 2018 07:50:15 Helpful(0) Helpful(0)

Hi Sergio,

Thanks for your help.

The only thing I dont understand is whether the user with privilege level 1 needs to start system view to perform shutdown the interfaces or is it possible without going in system view? Thats the only thing im not sure about it
  • x
  • convention：
yangyong
yangyong Created Jul 6, 2018 06:49:39 Helpful(0) Helpful(0)

Normally, an user that have privilege level 1 has access only to the user-view so just to display commands not to system-view. But with that command you change the privilege command structure, in this case you allow the level 1 users to perform shutdown for interfaces. This can be done for other commands too.
  • x
  • convention：
yoface
yoface Created Jul 11, 2018 15:02:18 Helpful(0) Helpful(0)

Ok thank you. But my question was if the user needs higher permissions as privilege level 1 because he must enter this command in the system view level.
I tried it without system view to shutdown the ports with that privilege level 1 user but apparently the command is not found from the switch.
Or do I have to enter a specific command to shutdown ports without system views?
  • x
  • convention：
Sergio93
Sergio93 Created Jul 12, 2018 07:15:19 Helpful(0) Helpful(0)

Hi Flo,

Please test after adding also this command :
[Huawei]command-privilege level 1 view shell system-view
  • x
  • convention：
BEST ANSWER! If you think I earn it!
If this post was useful to you, please click the Helpful button and flag my post as a "BEST ANSWER" so others can benefit. Thank you
12
Back to list

Reply

Reply
Advanced
B Color Image Link Quote Code Smilies
You need to log in to reply to the post Login | Register

Notice Notice: To protect the legitimate rights and interests of you, the community, and third parties, do not release content that may bring legal risks to all parties, including but are not limited to the following:
  • Politically sensitive content
  • Content concerning pornography, gambling, and drug abuse
  • Content that may disclose or infringe upon others ' commercial secrets, intellectual properties, including trade marks, copyrights, and patents, and personal privacy
Do not share your account and password with others. All operations performed using your account will be regarded as your own actions and all consequences arising therefrom will be borne by you. For details, see " Privacy."
If the attachment button is not available, update the Adobe Flash Player to the latest version!
Login and enjoy all the member benefits

Login and enjoy all the member benefits

Login
Huawei Website Support About Huawei Privacy Terms of Use
Huawei Enterprise Huawei Carrier Forum Training & Certification

Copyright © 2019 Huawei Technologies Co., Ltd. All rights reserved.

APP