System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Configure a task group

Updated: September 18, 2026

Want to summarize with AI?

Log in

Guides users through the process of setting up task groups for AAA services, including configuring associated user groups, avoiding reserved usernames, and creating local AAA users to streamline administrative task assignment.

Create a task group to define permissions for AAA operations by associating task IDs.

AAA task groups let you assign specific permissions (read, write, execute, debug) to users through task IDs. Task IDs define which operations a user can perform. Users are placed in user groups that reference task groups, giving them the set of permissions you configure.

Before you begin

  • Review the list and purpose of available AAA task IDs on your router.

  • Use the show aaa task supported command to display all supported task IDs.

  • Only users with write permission for the AAA task ID can configure task groups

Procedure

  1. Enter global configuration mode.

    Example:

    Router# configure

    Enters global configuration mode.

  2. Create a task group.

    Example:

    Router(config)# taskgroup beta

    Creates a name for a particular task group and enters task group configuration submode.

    • Specific task groups can be removed from the system by specifying the no form of the taskgroup command.

  3. Add a description for the task group.

    Example:

    Router(config-tg)# description this is a sample task group description

    (Optional) Creates a description of the task group named in Step 2.

  4. Add task IDs with the required permission to the task group.

    Example:

    Router(config-tg)# task read bgp

    Specifies a task ID to be associated with the task group named in Step 2.

    • Assigns read permission for any CLI or API invocations associated with that task ID and performed by a member of the task group.

    • Specific task IDs can be removed from a task group by specifying the no prefix for the task command.

After configuring all required task groups, proceed to set up user groups as described in the "Configuring User Groups" section.

Configure a user group

Create a user group with specified permissions by associating it with one or more task groups.

User groups allow you to manage permissions for multiple users efficiently. Task groups define sets of allowed actions. Only users with the WRITE:AAA task ID can configure user groups. User groups cannot inherit properties from predefined groups such as owner-sdr. Deleting a referenced user group triggers a warning.

Before you begin

  • Ensure you have WRITE:AAA privileges.

  • Review task groups to determine which permissions should be inherited.

Procedure

  1. Enter global configuration mode

    Example:

    Router# configure

    Enters global configuration mode.

  2. Create a user group.

    Example:

    Router(config)# usergroup beta

    Creates a name for a particular user group and enters user group configuration submode.

    • Specific user groups can be removed from the system by specifying the no form of the usergroup command.

  3. (Optional) Add a description to the user group.

    Example:

    Router(config-ug)# description this is a sample user group description

    (Optional) Creates a description of the user group named in Step 2.

  4. (Optional) Inherit permissions from another user group.

    Example:

    Router(config-ug)# inherit usergroup sales

    • Explicitly defines permissions for the user group.

  5. Associate the user group with one or more task groups

    Example:

    Router(config-ug)# taskgroup beta

    Associates the user group named in Step 2 with the task group named in this step.

    • The user group takes on the configuration attributes (task ID list and permissions) already defined for the entered task group.

    • Repeat this step for each task group to assign.

The user group configuration is completed and committed. The group inherits permissions from specified task groups and user groups as configured.

Avoid reserved local usernames

Do not use the following reserved words as local usernames:

  • backup

  • bin

  • bind

  • daemon

  • dhcp

  • games

  • gnat

  • irc

  • ip

  • list

  • mail

  • man

  • messagebus

  • news

  • nobody

  • proxy

  • rpc

  • root

  • sys

  • sync

  • systemd-timesync

  • systemd-network

  • systemd-bus-proxy

  • sshd

  • uucp

  • www-data

Configure a local AAA user

Create or update a local user who can authenticate to the router and receive task permissions based on user group membership.

Each user is uniquely identified by a username in the administrative domain. Membership in a user group provides task permissions. From Cisco IOS XR Software Release 24.3.1 and later, the router can synchronize up to 100 valid Linux-compatible users to the Linux infrastructure and up to 20 users to the standby route processor in dual-RP routers.

Before you begin

Create the task groups and user groups you want to assign to the user before configuring the user account.

Procedure

  1. Enter global configuration mode.

    Example:

    Router# configure

    Enters global configuration mode.

  2. Specify the username for the new user or update an existing user.

    Example:

    Router(config)# username user1

    Creates a name for a new user (or identifies a current user) and enters username configuration submode.

    • The username must be a single word—no spaces or quotation marks are allowed.

  3. Set a password or secret for the user.

    Example:

    Router(config-un)# password 0 pwd1

    Example:

    Router(config-un)# secret 0 sec1

    • password {0 | 7} password

    • secret {0 | 5 | 8 | 9 | 10} secret

    Specifies a password for the user named in step 2.

    • Use the secret command to create a secure login password for the user names specified in step 2.

    • Entering 0 following the password command specifies that an unencrypted (clear-text) password follows. Entering 7 following the password command specifies that an encrypted password follows.

    • Entering 0 following the secret command specifies that a secure unencrypted (clear-text) password follows. Entering 5 following the secret command specifies that a secure encrypted password follows.

    • Type 0 is the default for the password and secret commands.

  4. Assign the user to at least one user group.

    Example:

    Router(config-un)# group sysadmin

    • The user inherits all attributes of the specified user group. The user takes on all attributes of the user group, as defined by that user group's association to various task groups.

    • Each user must be assigned to at least one user group. A user may belong to multiple user groups.

    • Repeat step 4 for each user group to be associated with the user specified in step 2.

The user configuration is complete. The user account is created or updated with a password or secret, assigned to at least one user group, and changes are successfully committed.