S5720 security level for only port control

StarOfWest · Created Aug 9, 2018 06:11:31

You need to do some extra configuration.
1. Define access to system view.
2. define interfaces for which you allow access.
3. define shutdown interface command, but pay attention whether is l2 or l3 interface.
4. define undo shutdown command, i believe you want level 1 user to activate the interface back

command-privilege level 1 view shell system-view
command-privilege level 1 view system interface GigabitEthernet0/0/1
command-privilege level 1 view system interface GigabitEthernet0/0/2
command-privilege level 1 view system interface GigabitEthernet0/0/3
command-privilege level 1 view gigabitethernet shutdown
command-privilege level 1 view gigabitethernet-l2 shutdown
command-privilege level 1 view gigabitethernet undo shutdown
command-privilege level 1 view gigabitethernet-l2 undo shutdown

Cheers

Sergio93 · Created Jun 29, 2018 14:06:41

Hi Flo,

You can use the command below to add the privilege of shutdown command in interface view for a privilege level of 1 for example. Users with privilege 1 have access only to display commands, but you can add also privilege level for shutdown interface in their their level :
It should be like this :
<HUAWEI> system-view
[HUAWEI] command-privilege level 1 view inteface shutdown

Please try and confirm if this is what you need.
Command reference :
http://support.huawei.com/hedex/hdx.do?docid=EDOC1000135317&id=command-privilege_level&text=command-privilege%252520level&lang=en

Sergio93 · Created Jun 29, 2018 14:09:53

Posted by Sergio93 at 2018-06-29 14:06 Hi Flo,You can use the command below to add the privilege of shutdown command in interface view for ...

Sorry, it should be like this :
<HUAWEI> system-view
[HUAWEI] command-privilege level 1 view gigabitethernet shutdown

andsta · Created Jun 29, 2018 14:10:34

Hello yoface,

Please refer to the following link: http://support.huawei.com/hedex/hdx.do?docid=EDOC1000161579&id=user_privilege&text=user%252520privilege&lang=en

If I understand right you want to restrict the user to only use some commands. You can restrict the user to read the config using user privilege level 1 or 2 ( detailed in the documentation above).
Regarding the reboot and shut down of the interfaces after applying user privilege I hope this document about command-privilege level may help you:
http://support.huawei.com/hedex/pages/EDOC1000161579DEG0801J/04/EDOC1000161579DEG0801J/04/resources/dc/command-privilege_level.html

yoface · Created Jun 29, 2018 15:15:52

Hi all

thank you for your help, that looks good so far!

When I want to test to shutdown a port with the new created user with privilege level 1 rights and command-privilege level 1 view gigabitethernet shutdown - how is the command to shutdown a port with this account?

I see that I cant do system view or something else. How does that works ?

Sergio93 · Created Jun 29, 2018 16:02:06

Hi Flo,

Normally, an user that have privilege level 1 has access only to the user-view so just to display commands not to system-view. But with that command you change the privilege command structure, in this case you allow the level 1 users to perform shutdown for interfaces. This can be done for other commands too.
Hope this is clear.

yoface · Created Jul 5, 2018 07:50:15

Hi Sergio,

Thanks for your help.

The only thing I dont understand is whether the user with privilege level 1 needs to start system view to perform shutdown the interfaces or is it possible without going in system view? Thats the only thing im not sure about it

yangyong · Created Jul 6, 2018 06:49:39

Normally, an user that have privilege level 1 has access only to the user-view so just to display commands not to system-view. But with that command you change the privilege command structure, in this case you allow the level 1 users to perform shutdown for interfaces. This can be done for other commands too.

yoface · Created Jul 11, 2018 15:02:18

Ok thank you. But my question was if the user needs higher permissions as privilege level 1 because he must enter this command in the system view level.
I tried it without system view to shutdown the ports with that privilege level 1 user but apparently the command is not found from the switch.
Or do I have to enter a specific command to shutdown ports without system views?

Sergio93 · Created Jul 12, 2018 07:15:19

Hi Flo,

Please test after adding also this command :
[Huawei]command-privilege level 1 view shell system-view

Enterprise

Consumer

Corporate

Carriers

S5720 security level for only port control

Third Party’s Trade Secret