Setting a user password and privilege level, Configuring user attributes – Cisco ASA 5505 User Manual

Page 1506

Advertising
background image

67-80

Cisco ASA 5500 Series Configuration Guide using the CLI

Chapter 67 Configuring Connection Profiles, Group Policies, and Users

Configuring User Attributes

The internal user authentication database consists of the users entered with the username command. The
login command uses this database for authentication. To add a user to the ASA database, enter the
username command in global configuration mode. To remove a user, use the no version of this command
with the username you want to remove. To remove all usernames, use the clear configure username
command without appending a username.

Setting a User Password and Privilege Level

Enter the username command to assign a password and a privilege level for a user. You can enter the
nopassword keyword to specify that this user does not require a password. If you do specify a password,
you can specify whether that password is stored in an encrypted form.

The optional privilege keyword lets you set a privilege level for this user. Privilege levels range from 0
(the lowest) through 15. System administrators generally have the highest privilege level. The default
level is 2.

hostname(config)# username name {nopassword | password password [encrypted]} [privilege

priv_level]}

hostname(config)# no username [name]

Table 67-8

describes the meaning of the keywords and variables used in this command.

Table 67-8

username Command Keywords and Variables

By default, VPN users that you add with this command have no attributes or group policy association.
You must explicitly configure all values.

The following example shows how to configure a user named anyuser with an encrypted password of
pw_12345678 and a privilege level of 12:

hostname(config)# username anyuser password pw_12345678 encrypted privilege 12

hostname(config)#

Configuring User Attributes

After configuring the user’s password (if any) and privilege level, you set the other attributes. These can
be in any order. To remove any attribute-value pair, enter the no form of the command.

Enter username mode by entering the username command with the attributes keyword:

hostname(config)# username name attributes

hostname(config-username)#

The prompt changes to indicate the new mode. You can now configure the attributes.

Keyword/Variable

Meaning

encrypted

Indicates that the password is encrypted.

name

Provides the name of the user.

nopassword

Indicates that this user needs no password.

password password

Indicates that this user has a password, and provides the password.

privilege priv_level

Sets a privilege level for this user. The range is from 0 to 15, with lower
numbers having less ability to use commands and administer the ASA. The
default privilege level is 2. The typical privilege level for a system
administrator is 15.

Advertising