Creates a new user account or changes the access privileges on an existing account.
Each new user is granted the Monitor role by default. An administrator can change the role or give a user no role; a user with no role cannot log in to the appliance. If a role is changed while the affected user is logged in, the user will be forcibly logged out. When the user logs in again, the capabilities associated with the new role are available to the user.
Each role has a corresponding system account by the same name that has the role. System accounts cannot be deleted or modified, with the exception of being locked out so they cannot be used to log in. By default, the provided system accounts for the Operator, Analyst, and Auditor roles have the "local login disabled" status, and are prevented from logging in. A user with this account status can still authenticate remotely and be mapped to this user account. New accounts with the Monitor role default to the "Account locked out" status for security reasons and cannot log in until an administrator changes their account status.
For details about roles and their capabilities, see the "User Accounts" information in the Operator's Guide for the appliance.
Use the no form of this command to delete or disable options. The no username <username> role command gives the user no role, so the user can do nothing but log out.
Note
The default password is “admin” but when you log in and are required to change the default password, be sure your new password is at least 8 characters in length.
The "root" user cannot log in via SSH.
Syntax
[no] username usernam eaccess network enable
[no] username username role type
[no] username username full-name
[no] username username subnet network_prefix
[no] username username vlan vlan_identifier
username disable [password] | local-login
Parameters
username
Name of a new user account or an existing account whose access privileges you want to change.
role type
Type of access privileges assigned to the user:
admin - Access to all the functions except the Trellix Web services API.
Note
To prevent an “admin” user from logging in to the appliance via SSH, use the no form of this command: no username admin access network enable. To allow an “admin” user login access to the appliance via SSH, issue the command: username admin access network enable.
monitor—Read-only access to some things the admin role can change or configure.
operator—Access to a subset of the capabilities associated with the admin role.
analyst—Access to capabilities associated with detecting malware and taking appropriate action, including setting up alerts and reports.
auditor—Access to capabilities associated with reviewing audit logs and performing forensic analysis to trace how events occurred.
password
Password, may include specification of the following types:
0 password. Specifies a cleartext password. Enter the cleartext string.
7 password. Specifies an encrypted password. Enter the encrypted string.
full-name
Sets the full name for the specified user.
subnet network_prefix
Configures a subnet for the user account.
vlan vlan_identifier
Configures a VLAN ID for the user account.
disable
Disables the user from logging in.The no form of this command restores the ability to log in. There are two options:
password—Disables the user from logging in with a password.local-login—Disables the user from logging in locally, so the user can only log in remotely.
Example
The following example creates the user “jsmith” with operator privileges.
hostname (config) # username jsmith role operator
User role
Admin
Command mode
Config