Administrative Roles

A system user can be a member of a class that allows the user to act as a specific kind of administrator for the system. Requiring a specific role to view or modify an item restricts the extent of information a user can obtain from the system. It also limits how much of the system is open to modification or observation by a user. You (the system administrator) should use the following guidelines when you are designing administrative roles:

• Do not allow any user to log in to the system as root.

• Restrict each user to the smallest set of privileges needed to perform the user’s duties.

• Do not allow any user to belong to a login class containing the shell permission flag. The shell permission flag allows users to run the start shell command from the CLI.

• Allow users to have rollback permissions. Rollback permissions allow users to undo an action performed by an administrator but does not allow them to commit the changes.

You can assign an administrative role to a user by configuring a login class to have the privileges required for the role. You can configure each class to allow or deny access to configuration statements and commands by name. These restrictions override and take precedence over any permission flags also configured in the class. You can assign one of the following role attributes to an administrative user:

• Crypto-administrator—Allows the user to configure and monitor cryptographic data.

• Security-administrator—Allows the user to configure and monitor security data.

• Audit-administrator—Allows the user to configure and monitor audit data.

• IDS-administrator—Allows the user to monitor and clear the intrusion detection service (IDS) security logs.

Each role can perform the following specific management functions:

• Cryptographic Administrator

  • Configures the cryptographic self-test.

  • Modifies the cryptographic security data parameters.

• Audit Administrator

  • Configures and deletes the audit review search-and-sort feature.

  • Searches and sorts audit records.

  • Configures search and sort parameters.

  • Manually deletes audit logs.

• Security Administrator

  • Invokes, determines, and modifies the cryptographic self-test behavior.

  • Enables, disables, determines, and modifies the audit analysis and audit selection functions, and configures the device to automatically delete audit logs.

  • Enables or disables security alarms.

  • Specifies limits for quotas on Transport Layer connections.

  • Specifies the limits, network identifiers, and time periods for quotas on controlled connection-oriented resources.

  • Specifies the network addresses permitted to use Internet Control Message Protocol (ICMP) or Address Resolution Protocol (ARP).

  • Configures the time and date used in time stamps.

  • Queries, modifies, deletes, and creates the information flow or access control rules and attributes for the unauthenticated information flow security function policy (SFP), the authenticated information flow security function policy, the unauthenticated device services, and the discretionary access control policy.

  • Specifies initial values that override default values when object information is created under unauthenticated information flow SFP, the authenticated information flow SFP, the unauthenticated target of evaluation (TOE) services, and the discretionary access control policy.

  • Creates, deletes, or modifies the rules that control the address from which management sessions can be established.

  • Specifies and revokes security attributes associated with the users, subjects, and objects.

  • Specifies the percentage of audit storage capacity at which the device alerts administrators.

  • Handles authentication failures and modifies the number of failed authentication attempts through SSH or from the CLI that can occur before progressive throttling is enforced for further authentication attempts and before the connection is dropped.

  • Manages basic network configuration of the device.

• IDS Administrator—Specifies IDS security alarms, intrusion alarms, audit selections, and audit data.

You must set the security-role attribute in the classes created for these administrative roles. This attribute restricts which users can show and clear the security logs, actions that cannot be performed through configuration alone.

For example, you must set the security-role attribute in the ids-admin class created for the IDS administrator role if you want to restrict clearing and showing IDS logs to the IDS administrator role. Likewise, you must set the security-role to one of the other admin values to restrict that class from being able to clear and show non-IDS logs only.

This example shows how to configure individual administrative roles for a distinct, unique set of privileges apart from all other administrative roles.

Superuser privileges give a user permission to use any command on the router and are generally reserved for a select few users such as system administrators. You (the system administrator) need to protect the local administrator account with a password to prevent unauthorized users from gaining access to superuser commands. These superuser commands can be used to alter the system configuration. Users with RADIUS authentication should also configure a local password. If the RADIUS server does not respond, the login process reverts to local password authentication on the local administrator account.

The following example shows how to configure a password-protected local administration account called admin with superuser privileges: