Cisco 1000 Series Connected Grid Routers Security Software Configuration Guide

About User Accounts

You can configure up to a maximum of 256 user accounts. Cisco CG-OS provides one default user account: admin .

By default, the user account does not expire unless you explicitly configure it to expire. The expire option determines the date when Cisco CG-OS disables the user account.

Tip The following words are reserved and cannot be used to configure users: bin, daemon, adm, lp, sync, shutdown, halt, mail, news, uucp, operator, games, gopher, ftp, nobody, nscd, mailnull, root, rpc, rpcuser, xfs, gdm, mtsuser, ftpuser, man, and sys.

Characteristics of Strong Passwords

A strong password has the following characteristics:

• At least eight characters long
• Does not contain many consecutive characters (such as “abcd”)
• Does not contain many repeating characters (such as “aaabbb”)
• Does not contain dictionary words
• Does not contain proper names
• Contains both uppercase and lowercase characters
• Contains numbers

The following are examples of strong passwords:

• If2CoM18
• 2004AsdfLkj30
• Cb1955S21

Note Please note these important notes about passwords on the Cisco CG-OS router:

• User passwords are not displayed in the configuration files.
• Clear text passwords cannot contain dollar signs ($) or spaces anywhere in the password. Also, they cannot include these special characters at the beginning of the password: quotation marks (" or '), vertical bars (|), or right angle brackets (>).
• When a password is trivial (such as a short, easy-to-decipher password), Cisco CG-OS rejects the password configuration when password-strength checking is enabled. (See Enabling Password-Strength Checking.) Be sure to configure a strong password as shown in the sample configuration. Passwords are case sensitive.

About User Roles

User roles contain rules that define the operations allowed for the user who is assigned the role. Each user role can contain multiple rules and each user can have multiple roles. For example, if role1 allows access only to configuration operations, and role2 allows access only to debug operations, then users who belong to both role1 and role2 can access configuration and debug operations. You can also change a user role interface policy to limit the interfaces that the user can access.

Cisco CG-OS provides four default user roles within the default VDC:

• network-admin—Complete read-and-write access to the entire Cisco CG-OS router
• network-operator—Complete read access to the entire Cisco CG-OS router
• vdc-admin—Read-and-write access limited to a VDC (in this case, the default VDC)
• vdc-operator—Read access limited to a VDC (in this case, the default VDC)

Note You cannot change the default user roles.

You can create custom roles within the default VDC. By default, the user roles that you create allow access only to the show , exit , end , and configure terminal commands.You must add rules to allow users to display or configure features.

Note When you belong to multiple roles, you can execute a combination of all the commands permitted by these roles. Access to a command takes priority over being denied access to a command. For example, suppose a user has RoleA, which denied access to the configuration commands. However, the user also has RoleB, which has access to the configuration commands. In this case, the user has access to the configuration commands.

About User Role Rules

The rule is the basic element of a role. A rule defines what operations the role allows the user to perform. You can apply rules for the following parameters:

• Command—A command or group of commands defined in a regular expression
• Feature—Commands that apply to a function provided by Cisco CG-OS
• Feature group—Default or user-defined group of features

These parameters create a hierarchical relationship. The most basic control parameter is the command. The next control parameter is the feature, which represents all commands associated with the feature. The last control parameter is the feature group. The feature group combines related features and allows you to easily manage the rules. Cisco CG-OS also supports the predefined feature group L3 that you can use.

You can configure up to 256 rules for each role.

The user-specified rule number determines the order in which the rules are applied. Rules are applied in descending order. For example, when a role has three rules, rule 3 is applied before rule 2, which is applied before rule 1.

BEFORE YOU BEGIN

No prerequisites.

DETAILED STEPS

EXAMPLE

This example shows how to enable password-strength checking.

BEFORE YOU BEGIN

Determine which roles to assign to which user accounts.

DETAILED STEPS

EXAMPLE

This example shows how to configure a user account.

Creating User Roles and Rules

You can configure up to 64 user roles. Each user role can have up to 256 rules. You can assign a user role to more that one user account.

The rule number that you specify determines the order in which the rules are applied. Cisco CG-OS applies the rules in descending order. For example, when a role has three rules, rule 3 is applied before rule 2, which is applied before rule 1.

BEFORE YOU BEGIN

Identify which roles and rules must be assigned to each user account.

DETAILED STEPS

EXAMPLE

This example shows how to create the user role UserA and define rules for that user.

Creating Feature Groups

You can create custom feature groups to add to the default list of features provided by Cisco CG-OS. These groups contain one or more of the features. You can create up to 64 feature groups on the
Cisco CG-OS router.

Note You cannot change the default feature group L3.

BEFORE YOU BEGIN

Identify any specific features that must be specified in the Cisco CG-OS router.

DETAILED STEPS

EXAMPLE

This example shows how to create the custom feature group GroupA to expand the default list of features provided by Cisco CG-OS.

router_cgr01(config-role-featuregrp)# feature abc

router_cgr01(config-role-featuregrp)# copy running-config startup-config

Changing User Role Interface Policies

You can change a user role interface policy to limit the interfaces that the user can access. By default, a user role (unless specifically configured otherwise) allows a user to have access to all interfaces on the Cisco CG-OS router.

Note You cannot change the default roles network-admin, network-operator, vdc-admin, and vdc-operator.

BEFORE YOU BEGIN

Create one or more user roles. (See Creating User Roles and Rules.)

DETAILED STEPS

EXAMPLE

This example shows how to change a user role interface policy to limit the user to be able to access and configure only specific Ethernet interfaces on the Cisco CG-OS router.