Dell Configuration Guide for the S4048–ON System 9.14.2.4

Modifying Command Permissions for Roles

You can modify (add or delete) command permissions for newly created user roles and system defined roles using the role mode { { { addrole | deleterole } role-name } | reset } command command in Configuration mode.

If you add or delete command permissions using the role command, those changes only apply to the specific user role. They do not apply to other roles that have inheritance from that role. Authorization and accounting only apply to the roles specified in that configuration.

When you modify a command for a role, you specify the role, the mode, and whether you want to restrict access using the deleterole keyword or grant access using the addrole keyword followed by the command you are controlling access.

The following output displays the modes available for the role command.

DellEMC(conf)#role  ?
configure            Global configuration mode               
exec                 Exec Mode                               
interface            Interface configuration mode            
line                 Line Configuration mode                 
route-map            Route map configuration mode            
router               Router configuration mode           

Examples: Deny Network Administrator from Using the show users Command.

The following example denies the netadmin role from using the show users command and then verifies that netadmin cannot access the show users command in exec mode. Note that the netadmin role is not listed in the Role access: secadmin,sysadmin, which means the netadmin cannot access the show users command.

DellEMC(conf)#role exec deleterole netadmin show users

DellEMC#show role mode exec show users
Role access: secadmin,sysadmin

Example: Allow Security Administrator to Configure Spanning Tree

DellEMC(conf)#role configure addrole secadmin protocol spanning-tree 

Example: Allow Security Administrator to Access Interface Mode

DellEMC(conf)#role configure addrole secadmin ?
LINE       Initial keywords of the command to modify
DellEMC(conf)#role configure addrole secadmin interface 

Example: Allow Security Administrator to Access Only 10-Gigabit Ethernet Interfaces

DellEMC(conf)#role configure addrole secadmin ?
LINE            Initial keywords of the command to modify
DellEMC(conf)#role configure addrole secadmin interface tengigabitethernet

DellEMC(conf)#show role mode configure interface
Role access: netadmin, secadmin, sysadmin

Example: Verify that the Security Administrator Can Access Interface Mode

The following example shows that the secadmin role can now access Interface mode (highlighted in bold).

Role        Inheritance  Modes                                             
netoperator                                                                              
netadmin                 Exec Config Interface Router IP RouteMap Protocol MAC 
secadmin                 Exec Config Interface Line                               
sysadmin                 Exec Config Interface Line Router IP RouteMap Protocol MAC

Example: Remove Security Administrator Access to Line Mode.

The following example removes the secadmin access to LINE mode and then verifies that the security administrator can no longer access LINE mode, using the show role mode configure line command in EXEC Privilege mode.

DellEMC(conf)#role configure deleterole secadmin ?
LINE          Initial keywords of the command to modify
DellEMC(conf)#role configure deleterole secadmin line 

DellEMC(conf)#do show role mode ?
configure   					Global configuration mode               
exec                  Exec Mode                               
interface             Interface configuration mode            
line                  Line Configuration mode                 
route-map             Route map configuration mode            
router                Router configuration mode   

DellEMC(conf)#do show role mode configure line
Role access:sysadmin

Example: Grant and Remove Security Administrator Access to Configure Protocols

DellEMC(conf)#role configure addrole secadmin protocol
DellEMC(conf)#role configure deleterole secadmin protocol

Example: Resets Only the Security Administrator role to its original setting.

The following example resets only the secadmin role to its original setting. 

DellEMC(conf)#no role configure addrole secadmin protocol 

Example: Reset System-Defined Roles and Roles that Inherit Permissions

DellEMC(conf)#role configure reset protocol