Szerkesztő:LinguisticMystic/ru/безопасность/5

🔑 05.0. Introduction: Assigning Administrative Roles

In network environments, not all users require full administrative privileges. Assigning appropriate administrative roles enhances security by limiting access based on job responsibilities. This principle is known as the Principle of Least Privilege (PoLP).

---

🌟 1. Why Assign Administrative Roles?

1. Improved Security:
   • Limits exposure to sensitive configurations and data.
     
   • Reduces the risk of accidental misconfiguration or malicious activity.
2. Operational Efficiency:
   • Allows administrators to focus on specific tasks.
     
   • Simplifies troubleshooting and network management.
3. Accountability and Auditing:
   • Tracks user activities for auditing purposes.
     
   • Ensures changes are logged and attributed to specific users.
4. Compliance:
   • Meets regulatory requirements by enforcing role-based access.

---

🔒 2. Key Concepts in Administrative Role Assignment

1. Privilege Levels:
   • Cisco IOS has 16 privilege levels (0-15).
     
   • Level 0: Limited commands (disable, logout, enable).
     
   • Level 1: User EXEC mode (basic read-only access).
     
   • Level 15: Full administrative access (privileged EXEC mode).
2. Role-Based Access Control (RBAC):
   • Assigns users to roles with specific command permissions.
     
   • Prevents users from accessing commands outside their roles.
3. AAA (Authentication, Authorization, and Accounting):
   • Provides centralized control over user access.
     
   • Supports integration with RADIUS and TACACS+ servers.

---

⚙️ 3. Best Practices for Role Assignment

1. Follow Least Privilege:
   • Grant users only the permissions they need.
2. Use Individual User Accounts:
   • Avoid shared accounts to ensure accountability.
3. Implement Strong Passwords:
   • Enforce complex passwords and multi-factor authentication (MFA).
4. Monitor and Log Activities:
   • Enable logging to track administrative actions.
5. Regularly Review Roles:
   • Update roles based on changing job responsibilities.

---

📊 4. Implementation Methods

1. Privilege Levels:
   • Customize command access based on user privilege levels.
2. Role-Based CLI Access:
   • Create custom roles using the Cisco Role-Based CLI feature.
3. AAA Server Integration:
   • Centralize user authentication and role assignment.

---

✅ 5. Summary of Benefits

1. Security: Limits access to sensitive configurations.
   
2. Accountability: Tracks administrative actions.
   
3. Efficiency: Simplifies network management.
   
4. Compliance: Meets regulatory requirements.

---

🔒 05.1. Configure Privilege Levels

Cisco IOS uses 16 privilege levels (0 to 15) to control access to commands. By default:

• Level 0: Basic commands (disable, logout, enable, exit).
  
• Level 1: User EXEC mode (read-only).
  
• Level 15: Privileged EXEC mode (full administrative access).

Intermediate levels (2-14) can be customized for specific roles.

---

🌟 1. Why Configure Privilege Levels?

1. Enhanced Security: Restricts unauthorized access to critical commands.
   
2. Role-Based Access: Assigns users different access levels based on job roles.
   
3. Accountability: Tracks user actions with different privilege levels.

---

⚙️ 2. Configuring Privilege Levels

---

2.1. Set Privilege Level for Users

Create user accounts with different privilege levels.

!
username admin privilege 15 secret AdminPass123
username support privilege 5 secret SupportPass123
!

Explanation:
- privilege 15 grants full administrative rights.
- privilege 5 limits access to specific commands.
- secret ensures password encryption.

---

2.2. Assign Privilege Levels to Commands

You can assign specific commands to different privilege levels. Example 1: Assign the show running-config command to privilege level 5.

!
privilege exec level 5 show running-config
!

Example 2: Assign interface configuration commands to level 7.

!
privilege exec level 7 configure terminal
privilege exec level 7 interface
!

Explanation:
- Users at level 5 can now view the running configuration.
- Users at level 7 can enter configuration mode and modify interfaces.

---

2.3. Configure Enable Password for Specific Levels

Set passwords for different privilege levels. Example: Set an enable password for privilege level 5.

!
enable secret level 5 SupportPass123
!

Explanation:
- Users can access level 5 commands using this password.

---

2.4. Restrict VTY Access Based on Privilege Levels

Limit remote access by privilege level.

!
line vty 0 4
login local
privilege level 5
!

Explanation:
- Only users with privilege level 5 or higher can access the device remotely.

---

🔍 3. Verification and Testing

1. Verify User Privilege Level:

show privilege

Example Output:

Current privilege level is 5

2. Test User Access:

Log in with different user accounts and test access to commands.

---

📊 4. Monitoring and Logging

Enable logging to track user activities based on privilege levels.

!
logging buffered 10000
login on-success log
login on-failure log
!

Explanation:
- Logs successful and failed login attempts.

---

✅ 5. Summary of Key Commands

Task	Command Example
Create User with Privilege	username admin privilege 15 secret pass
Assign Command to Level	privilege exec level 5 show running-config
Set Enable Password	enable secret level 5 SupportPass123
Restrict VTY by Privilege	privilege level 5 in line vty
Verify Privilege Level	show privilege

---

⚔️ 6. Troubleshooting Tips

1. Access Denied: Ensure users have the correct privilege level for the desired command.
   
2. Command Not Found: Verify that the command is assigned to the appropriate level.
   
3. Password Prompt: Ensure enable passwords are configured for each privilege level.

---

🌟 7. Benefits of Privilege Levels

1. Granular Access: Limits users to authorized commands only.
   
2. Improved Security: Prevents unauthorized configuration changes.
   
3. Operational Efficiency: Assigns tasks based on job roles.

---

🔒 05.2. Configure Role-Based CLI

Role-Based CLI Access allows you to create custom administrative roles by defining which commands each role can execute. This is more flexible than privilege levels, providing fine-grained access control.

---

🌟 1. Why Use Role-Based CLI?

1. Granular Access Control: Assign specific commands to different roles.
   
2. Improved Security: Restrict access to sensitive commands.
   
3. Operational Efficiency: Ensure users can only perform job-related tasks.
   
4. Accountability: Track user activities based on assigned roles.

---

⚙️ 2. Key Components of Role-Based CLI

1. Views:
   • Views define what commands users in a specific role can access.
     
   • Multiple views can be created for different job functions.
2. Root View:
   • The highest view with full administrative privileges (similar to privilege level 15).
     
   • Required to create and manage other views.
3. User Assignment:
   • Users are assigned to views based on job responsibilities.

---

🛠️ 3. Configuration Steps for Role-Based CLI

---

3.1. Enable AAA (Authentication, Authorization, and Accounting)

AAA must be enabled to support role-based CLI.

!
aaa new-model
!

Explanation:
- AAA provides centralized authentication and authorization for role-based access.

---

3.2. Enable Root View

Set up the root view with a secure password.

!
enable view
enable secret strongpassword123
!

Explanation:
- enable view activates root view.
- The secret command secures access to the root view.

---

3.3. Create a New CLI View

1. Enter Root View:

!
enable view
!

2. Create a View:

!
parser view NetworkSupport
secret SupportPass123
!

Explanation:
- parser view creates a view named NetworkSupport.
- The secret secures access to the view.

---

3.4. Assign Commands to the View

Define which commands the view can execute.

!
view NetworkSupport
command exec include show
command exec include configure terminal
command exec include interface
!

Explanation:
- Users in the NetworkSupport view can run show, configure terminal, and interface commands.

---

3.5. Create User Accounts and Assign Views

Create user accounts associated with specific views.

!
username admin privilege 15 secret AdminPass123
username support view NetworkSupport secret SupportPass123
!

Explanation:
- The support user can only access commands defined in the NetworkSupport view.

---

3.6. Restrict VTY Access by View

Apply user-specific views to remote access.

!
line vty 0 4
login local
!

Explanation:
- Only users with defined views can access the device remotely.

---

🔍 4. Verification and Testing

1. Verify Available Views:

show parser view

2. Check User Privileges:

Log in as the support user and try different commands.

---

📊 5. Monitoring and Logging

Enable logging to track user activities by role.

!
logging buffered 10000
login on-success log
login on-failure log
!

Explanation:
- Logs successful and failed login attempts.

---

✅ 6. Summary of Key Commands

Task	Command Example
Enable AAA	aaa new-model
Create Root View	enable view
Create CLI View	parser view NetworkSupport
Assign Commands to View	command exec include show
Create User for View	username support view NetworkSupport secret pass
Verify Views	show parser view

---

⚔️ 7. Troubleshooting Tips

1. Access Denied: Ensure the user is assigned to the correct view.
   
2. Command Not Found: Verify that the command is included in the view.
   
3. Login Failure: Check user credentials and view passwords.

---

🌟 8. Benefits of Role-Based CLI

1. Enhanced Security: Restricts access to sensitive commands.
   
2. Granular Control: Assigns specific tasks to different roles.
   
3. Operational Efficiency: Reduces risk of configuration errors.
   
4. Accountability: Tracks user activities by role.

---

🔑 05.3. Assigning Administrative Roles Summary

Assigning administrative roles enhances network security by limiting user access based on job responsibilities. This ensures that users only have access to the commands and configurations they need.

---

🌟 1. Why Assign Administrative Roles?

1. Improved Security:
   • Limits access to sensitive configurations.
     
   • Prevents accidental or malicious changes.
2. Operational Efficiency:
   • Ensures users can only perform job-related tasks.
     
   • Simplifies troubleshooting and management.
3. Accountability and Auditing:
   • Tracks user activities and changes.
     
   • Facilitates auditing and compliance.
4. Principle of Least Privilege (PoLP):
   • Grants users the minimum access required for their roles.

---

🔒 2. Key Methods for Assigning Administrative Roles

There are two primary methods for controlling user access on Cisco devices:

1. Privilege Levels:
   • Cisco IOS has 16 privilege levels (0 to 15).
     
   • Default Levels:
     • Level 0: Basic commands (disable, logout, enable, exit).
       
     • Level 1: User EXEC mode (basic read-only access).
       
     • Level 15: Privileged EXEC mode (full administrative access).
       
   • Intermediate levels (2-14) can be customized for specific roles.
2. Role-Based CLI (RBAC):
   • Allows the creation of custom roles (views).
     
   • Users can only execute commands assigned to their view.
     
   • More granular than privilege levels.

---

🛠️ 3. Configuration Overview

3.1. Privilege Level Configuration

• Create User Accounts with Specific Privilege Levels:
  

username admin privilege 15 secret AdminPass123
username support privilege 5 secret SupportPass123

• Assign Commands to Privilege Levels:
  

privilege exec level 5 show running-config

• Set Enable Password for Specific Levels:
  

enable secret level 5 SupportPass123

• Restrict VTY Access by Privilege:
  

line vty 0 4
privilege level 5

---

3.2. Role-Based CLI Configuration (RBAC)

1. Enable AAA:
   

aaa new-model

2. Create Root View:
   

enable view
enable secret strongpassword123

3. Create CLI View:
   

parser view NetworkSupport
secret SupportPass123
command exec include show
command exec include configure terminal

4. Create User and Assign to View:
   

username support view NetworkSupport secret SupportPass123

---

🔍 4. Verification and Monitoring

1. Check Privilege Levels:
   

show privilege

2. Verify CLI Views:
   

show parser view

3. Monitor Logins and Activity:
   

show logging

---

📊 5. Benefits of Administrative Role Assignment

Benefit	Description
Security	Limits access to sensitive commands.
Granular Control	Customizes user permissions based on roles.
Operational Efficiency	Simplifies network management.
Accountability	Tracks user actions for auditing.
Compliance	Supports regulatory standards (e.g., PCI-DSS).

---

⚔️ 6. Best Practices for Assigning Roles

1. Follow Least Privilege: Grant users only the access they need.
   
2. Use Individual Accounts: Avoid shared accounts.
   
3. Enforce Strong Passwords: Ensure password complexity.
   
4. Monitor and Log Activity: Enable Syslog and AAA accounting.
   
5. Regularly Review Roles: Update roles based on job changes.

---

✅ 7. Summary of Key Commands

Task	Command Example
Create User with Privilege	username admin privilege 15 secret pass
Assign Command to Level	privilege exec level 5 show running-config
Create CLI View	parser view NetworkSupport
Assign Commands to View	command exec include show
Create User for View	username support view NetworkSupport secret pass
Verify Privilege	show privilege
Verify View	show parser view

---

🌟 8. Conclusion

Assigning administrative roles using privilege levels and Role-Based CLI improves network security, operational efficiency, and user accountability. Regularly reviewing and updating roles ensures ongoing protection and compliance.

---