使用command-privilege給H3C、華爲設備的用戶賬號受權

1、H3C設備的權限默認分爲0-3這四種級別

數值越小，用戶的級別越低
(1)訪問權限0 級 : ping、tracert、telnet 等網絡診斷小程序，不能夠dis current
(2)監控權限 1級: dis current、reset、可開debug這種高級系統診斷工具，不能進入system視圖進行配置，命令不能保存

(3)系統權限2級 :能夠配置除升級版本外的幾乎全部業務配置命令，包括建立用戶等，能夠保存
(4)管理權限3級:關係到系統的基本運行、系統支撐模塊功能的命令，這些命令對業務提供支撐做用。包括文件系統、FTP、TFTP、XModem

 

可使用user privilege level命令來設置用戶賬號登錄時的級別

 

2、如何擴展低級別的命令呢？

 

修改命令級別的方法就是在系統視圖下執行"command-privilege level level view view command"命令。可以使用"undo command-privilege view view command"恢復默認狀況。默認狀況，各個視圖下的每條命令都有指定的級別。命令中的參數說明以下：

level level：把後面指定的命令修改到的級別，取值範圍爲0~3。

view view：指定能夠執行後面指定的命令的命令行視圖名稱，view的取值中shell表示用戶視圖, 用戶模式提示符爲> 。該參數必須是command所在的視圖。

command：指定須要修改命令級別的命令。

 例如給權限0的用戶debugging權限的命令：
能夠在系統模式下用：command-privilege level 0 view shell debugging，

3、我給機構IT人員分配了level 1的基本權限用於操做H3C S3100二層交換機，並附加以下命令

command-privilege level 1 view shell system-view 
    

在用戶模式(shell)下可使用system命令進行系統視圖
   
   
   
   

command-privilege level 1 view system quit 
    

在system系統視圖模式下將quit命令定義爲可執行,不然不能退到用戶（shell）模式
   
   
   
   

command-privilege level 1 view system save
 command-privilege level 1 view shell save 
    

受權level 1在在用戶模式和system模式均可以save
   
   
   
   

command-privilege level 1 view system interface 
    

受權level 1在system系統視圖模式下能夠進入interface接口。

command-privilege level 1 view system interface Ethernet
 command-privilege level 1 view ethernet quit 
    

受權level 1在system系統視圖模式下能夠進入interface ethernet接口.
若是不配置ethernet quit，則用戶在ethernet接口模式下使用quit會直接退回到用戶模式(提示符爲>)，而不是退回system系統視圖

 

command-privilege level 1 view system interface Ethernet 1/0/1
 command-privilege level 1 view system interface Ethernet1/0/1 
    

兩條命令僅有一個空格的區別，但建議同時寫如上兩條，以方便進入接口。雖然只寫了eth1/0/1這一個接口，但同時能夠對其餘的ethernet端口進行，包括GigabitEthernet光接口都可以進入

 

command-privilege level 1 view ethernet shutdown
 command-privilege level 1 view ethernet undo
 command-privilege level 1 view ethernet undo shutdown 
    

受權level 1在ethernet接口模式下能夠對進行shutdown，undo shut操做，GigabitEthernet光接口則不能夠

command-privilege level 1 view ethernet mac-address 
    

 command-privilege level 1 view ethernet mac-address max-mac-count 
    

 command-privilege level 1 view ethernet mac-address max-mac-count 1 
    

 command-privilege level 1 view ethernet undo 
    

command-privilege level 1 view ethernet undo mac-address 
    

 command-privilege level 1 view ethernet undo mac-address max-mac-count 
    

受權level 1在ethernet接口模式下能夠限制該端口學習到的mac地址數

 

 

command-privilege level 1 view ethernet mac-address 
    

command-privilege level 1 view ethernet mac-address static 
    

command-privilege level 1 view ethernet mac-address static 0000-5e00-0001 
    

command-privilege level 1 view ethernet mac-address static 0000-5e00-0001 vlan 
    

command-privilege level 1 view ethernet mac-address static 0000-5e00-0001 vlan 70 
    

command-privilege level 1 view ethernet undo mac-address        
    

command-privilege level 1 view ethernet undo mac-address static 
    

command-privilege level 1 view ethernet undo mac-address static 0000-5e00-0001 
    

command-privilege level 1 view ethernet undo mac-address static 0000-5e00-0001 vlan 
    

command-privilege level 1 view ethernet undo mac-address static 0000-5e00-0001 vlan 70 
    

受權level 1在ethernet接口視圖下可靜態綁定mac地址到指定的端口、vlan
   
   
   
   

 

 

command-privilege level 1 view ethernet mac-address 
    

command-privilege level 1 view system mac-address static 
    

 command-privilege level 1 view system mac-address static 0000-5e00-0000 
    

 command-privilege level 1 view system mac-address static 0000-5e00-0000 interface 
    

 command-privilege level 1 view system mac-address static 0000-5e00-0000 interface Ethernet 
    

 command-privilege level 1 view system mac-address static 0000-5e00-0000 interface Ethernet 1/0/1 
    

 command-privilege level 1 view system mac-address static 0000-5e00-0000 interface Ethernet 1/0/1 vlan 
    

 command-privilege level 1 view system mac-address static 0000-5e00-0000 interface Ethernet 1/0/1 vlan 70 
    

command-privilege level 1 view system undo 
    

command-privilege level 1 view system undo mac-address 
    

 command-privilege level 1 view system undo mac-address static 
    

 command-privilege level 1 view system undo mac-address static 0000-5e00-0000 
    

 command-privilege level 1 view system undo mac-address static 0000-5e00-0000 interface 
    

 command-privilege level 1 view system undo mac-address static 0000-5e00-0000 interface Ethernet 
    

 command-privilege level 1 view system undo mac-address static 0000-5e00-0000 interface Ethernet 1/0/1 
    

 command-privilege level 1 view system undo mac-address static 0000-5e00-0000 interface Ethernet 1/0/1 vlan 
    

 command-privilege level 1 view system undo mac-address static 0000-5e00-0000 interface Ethernet 1/0/1 vlan 70 
    

受權level 1在system視圖下可靜態綁定mac地址到指定的端口、vlan
   
   
   
   

command-privilege level 1 view ethernet line-rate 
    

 command-privilege level 1 view ethernet line-rate inbound 
    

 command-privilege level 1 view ethernet line-rate inbound 64 
    

 command-privilege level 1 view ethernet line-rate outbound 
    

 command-privilege level 1 view ethernet line-rate outbound 64 
    

 command-privilege level 1 view ethernet undo line-rate 
    

 command-privilege level 1 view ethernet undo line-rate inbound 
    

 command-privilege level 1 view ethernet undo line-rate outbound 
    

受權level 1在ethernet接口模式下能夠限速

 

 

command-privilege level 1 view ethernet speed     
    

command-privilege level 1 view ethernet speed 100 
    

command-privilege level 1 view ethernet speed auto 
    

command-privilege level 1 view ethernet speed 10   
    

command-privilege level 1 view ethernet undo speed 
    

受權level 1在ethernet接口模式下能夠設定端口速率

 command-privilege level 1 view shell reset
  command-privilege level 1 view shell reset counters
  command-privilege level 1 view shell reset counters interface command-privilege level 1 view shell reset counters interface Ethernet 
    

 command-privilege level 1 view shell reset counters interface Ethernet 1/0/1 
    

受權level 1在用戶模式下能夠清除計數器

 

command-privilege level 1 view shell reset logbuffer
 command-privilege level 1 view shell reset arp
 command-privilege level 1 view shell reset stp
 command-privilege level 1 view shell reset ndp 
    

受權level 1在用戶模式下能夠清除日誌，清除arp，清除stp，清除ndp