Lists the key features, benefits, direct CLI commands, scope, state behavior, and command interface for gated shell access on Cisco IOS XR platforms.
Use this reference to determine whether a platform supports gated shell access and to identify the associated restrictions and CLI commands.
Key features:
-
Gates only direct shell access via supported CLI commands (such as bash , run , and attach ). Indirect access through scripts or internal processes is not gated in the initial release.
-
It enables restriction or unrestriction of gated shell access, ensuring that only authorized personnel can change shell-access policies.
-
Depends on the consent token infrastructure to be present and supported on the platform for operation.
-
The restricted-shell selection is stored in an HWTAM secure object.
|
Command |
Purpose |
|---|---|
|
platform security shell-access restrict challenge {cisco | owner} |
Initiates the Consent Token challenge for the selected Cisco or customer authorization path. |
|
platform security shell-access restrict response <response_string> |
Submits the Consent Token response to authorize and complete the shell-access restriction operation. |
|
platform security shell-access restrict terminate-auth |
Terminates the pending Consent Token authorization request for shell-access restriction. |
|
platform security shell-access unrestrict challenge {cisco | owner} |
Starts the Consent Token authorization flow to remove the restriction. |
|
platform security shell-access unrestrict response <response_string> |
Submits the Consent Token response for unrestriction. |
|
platform security shell-access unrestrict terminate-auth |
Terminates the pending unrestriction authorization request operation. |
|
show platform security shell-access status |
Displays the restricted-shell configuration and handshake status. |
The HWTAM Secure Object holds the restricted-shell selection and handshake state. The restricted-shell selection is preserved across reboots and reloads.