Creating User Profiles

This chapter covers the following topics:

Overview

Understanding the User profile parameters

Understanding command permissions

Sample User profiles

Customizing the environment for a User profile

Overview
Understanding the User profile parameters
Understanding command permissions
Sample User profiles
Customizing the environment for a User profile

Overview

User profiles are for MAX TNT system administration. Do not confuse them with Connection profiles. User profiles are used by administrators who need access to the MAX TNT command line interface to monitor or configure the unit. Connection profiles contain authentication and configuration information for a remote device or user and allow the remote user to connect to the MAX TNT for WAN or LAN access.

You can create any number of User profiles and fine-tune the privileges they allow. In addition to authentication and permission information, User profiles also contain parameters that affect how the user's environment appears at login.

The MAX TNT ships with two predefined User profiles, named Admin and Default. The Admin account is the super-user, with full read-write permissions. Default is set to the other extreme. It authorizes the minimal use of commands.

Many sites choose to create some administrative accounts in a read-only mode, to allow those users to check status windows, read log buffers, and execute diagnostic commands. You need at least one administrative account in read-write mode, but you may choose to create several such accounts.

Understanding the User profile parameters

Figure 7-1 describes common tasks you might have to perform to configure a User profile. The table includes a brief description of each task and lists the parameters you will use.

Table 7-1. Overview User profile tasks


Task	Description	Associated parameters
Setting the name and password	When you create a new User profile with the New command, the system creates a default instance of the profile and reads it into the edit buffer. The name and password you assign to the profile represent a user or host name and a password used to authenticate that user at login.	Name Password
Activating the profile	The User profile is activated when you first create it. If you set Active-Enabled to No, the profile is not available for use.	Active-Enabled
Assigning permissions	Permissions control which actions the user who logs in with this profile can perform on the MAX TNT.	Allow-Termserv Allow-System Allow-Diagnostic Allow-Update Allow-Password Allow-Code
Logging the user out when idle	With the Idle-Timeout setting, you can specify the number of seconds a Telnet session can remain logged in with no keyboard activity.	Idle-Timeout
Setting the command-line prompt	The default command-line prompt is `TNT>`. If you set the prompt to an asterisk, the MAX TNT uses the name parameter as the prompt. For example, for the `admin` User profile, the prompt would be `admin>`.	Prompt
Specifying which status windows are displayed at login	You can display status windows by default at login, and you can specify what information should be displayed initially in the top, bottom, and left windows.	Default-Status Left-Status Top-Status Bottom-Status
Defining which log messages will be displayed	You can specify that log messages should be displayed immediately in the interface, instead of written to a log. You can also specify at which level the immediate display should begin. The lowest level is `none`, indicating that no messages should be displayed in the command-line interface. The highest level is `debug`.	Log-Message-Level

Understanding command permissions

Permissions control which actions the user who logs in with a particular profile can perform on the MAX TNT. Each permission enables the use of a command class. When you use the Help command to display available commands, the left column shows command names, and the right column shows the command class. For example:

admin> ?
 ?                              ( user )
 arptable                       ( system )
 auth                           ( user )
 callroute                      ( diagnostic )
 clear                          ( user )
 clock-source                   ( diagnostic )
 clr-history                    ( system )
 connection                     ( system )
 date                           ( update )
 debug                          ( diagnostic )
 delete                         ( update )
 device                         ( diagnostic )
 dir                            ( system )
 dircode                        ( system )
 ether-display                  ( diagnostic )
 fatal-history                  ( system )
 format                         ( code )
 fsck                           ( code )
 get                            ( system )
 hdlc                           ( system )
 help                           ( user )
 if-admin                       ( diagnostic )
[More? <ret>=next entry, <sp>=next page, <^C>=abort]

Typically, read-write accounts enable the System command class. They might also enable the Update and Code command classes. Read-only accounts might be limited to the Diagnostic command class. Table 7-2 shows the commands associated with each permission:

Table 7-2. Permissions and associated commands


Permission	Command class	Commands in this class
N/A (always enabled)	User	? Auth Clear	Help Quit Whoami
`Allow-System`	System	ARP ARPtable Clr-history Connection Dir Dircode Fatal-History Get HDLC IGMP IPcache IProute Line List Log Modem	Netstat New OSPF Power Quiesce Read Refresh Set Show Status SWANlines T1channels Userstat Version View
`Allow-Diagnostic`	Diagnostic	Callroute Clock-Source Debug Device Ether-Display If-Admin	NSlookup Open Ping Rlogin Slot Telnet Traceroute
`Allow-Update`	Update	Date Delete Load Nvram	Reset Save Write
`Allow-Code`	Code	Format	Fsck
Allow-Rermserv	Termserv. This permission enables the user to invoke the Terminal-Server command and use the terminal-server interface.	Terminal-server
Allow-Password	N/A	See caution below.