System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases
Is this content helpful?
Thank you for your feedback. Your response has been recorded.
AI responses are currently only available to logged in users. Log in
Only ask questions about this document. To ask questions about this product as a whole, go to Technical Documentation .
Suggestions
Sorry, we couldn't generate a response for this query.
System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases
Updated: September 18, 2026
Want to summarize with AI?
Log inRestrict direct interactive root shell access on a supported Cisco IOS XR platform and store the restricted-shell selection in the Gated Shell Access HWTAM Secure Object.
Use this task to restrict supported direct, interactive root shell access by using a Cisco-signed Consent Token.
Generate the challenge string on the router.
RP/0/RP0/CPU0:ios# platform security shell-access restrict challenge cisco
Thu Aug 20 06:06:33.888 UTC
+--------------------------------------+
Node location: node0_RP0_CPU0
+--------------------------------------+
Challenge string:
<challenge_string>
This produces a challenge string containing the device ID, a nonce, and the requested action.
Submit the challenge string to a Cisco TAC engineer. Cisco verifies that the requester is the legitimate device owner and is authorized to perform the requested action. If verified, the TAC engineer provides a signed response string.
Paste the response string provided by the TAC engineer when prompted, to install the signed response on the router.
RP/0/RP0/CPU0:ios# platform security shell-access restrict response
Thu Aug 20 06:07:07.090 UTC
***************************************************************
Please enter challenge response string for node location node0_RP0_CPU0
***************************************************************
<response_string>
Successfully accepted challenge-response for Restrict Shell Access in node0_RP0_CPU0The router validates the signature and confirms that the device ID and nonce match its own records. If valid, this restricts the direct shell access.
Note
To access the root shell after restricting shell access, see Access a restricted shell.
If required, to terminate a pending Consent Token authorization request for shell-access restriction, see Terminate a pending Consent Token authorization request.
Need help?
(Requires a Cisco Service Contract)
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.