Filter
Top Products
47
Security
This chapter describes several ways to provide access security to the Dell Networking system.
For details about all the commands described in this chapter, refer to the Security chapter in the Dell
Networking OS Command Reference Guide.
Role-Based Access Control
With Role-Based Access Control (RBAC), access and authorization is controlled based on a user’s role.
Users are granted permissions based on their user roles, not on their individual user ID. User roles are
created for job functions and through those roles they acquire the permissions to perform their
associated job function.
This section contains the following sections:
• Overview of RBAC
• Privilege-or-role Mode versus Role-only Mode
• Configuring Role-based Only AAA Authorization
• System-Defined RBAC User Roles
• User Roles
• Role Accounting
• AAA Authentication and Authorization for Roles
• Display Information About User Roles
Overview of RBAC
With Role-Based Access Control (RBAC), access and authorization is controlled based on a user’s role.
Users are granted permissions based on their user roles, not on their individual user ID. User roles are
created for job functions and through those roles they acquire the permissions to perform their
associated job function. Each user can be assigned only a single role. Many users can have the same role.
The Dell Networking OS supports the constrained RBAC model. With a constrained RBAC model, you can
inherit permissions when you create a new user role, restrict or add commands a user can enter and the
actions the user can perform. This allows for greater flexibility in assigning permissions for each
command to each role and as a result, it is easier and much more efficient to administer user rights. If a
user’s role matches one of the allowed user roles for that command, then command authorization is
granted.
A constrained RBAC model provides for separation of duty and as a result, provides greater security than
the hierarchical RBAC model. Essentially, a constrained model puts some limitations around each role’s
permissions to allow you to partition of tasks. However, some inheritance is possible.
Default command permissions are based on CLI mode (such as configure, interface, router), any specific
command settings, and the permissions allowed by the privilege and role commands. The role command
Security
777