Local-User-Netconf

Local User

Resources Summary

YANG Path	get/get-config	edit-config	rpc
/local-password-policy	Y	merge, replace	—
/local-user-policy	Y	merge, replace, create, delete	—
/show-users-block-conf	—	—	Y
/show-users-blocked	—	—	Y
/show-users-brief	—	—	Y
/show-users-password-control	—	—	Y
/show-users-session-conf	—	—	Y
/unblock-users	—	—	Y
/users/{name}	Y	merge, replace, create, delete	—

Examples

This chapter provides examples on how to use Netconf to manage local_user configurations on AsterNOS devices.

Create New Local User

Request example to create a local user via edit-config.

<config>
<top>
    <users operation="create">
    <user>
        <name>test11</name>
        <password>123456</password>
        <privilege-level>show</privilege-level>
        <max-session>2</max-session>
    </user>
    <user>
        <name>test12</name>
        <password>123456</password>
        <privilege-level>config</privilege-level>
    </user>
    <user>
        <name>test13</name>
        <password>123456</password>
        <privilege-level>sys_admin</privilege-level>
    </user>
    </users>
</top>
</config>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:f78def8c-1164-4ec8-9af5-c204eecd7420">
    <ok/>
</rpc-reply>

Remove Specified Local User

Request example to remove a local user via edit-config.

<config>
<top>
    <users>
        <user operation="delete">
            <name>test11</name>
        </user>
    </users>
</top>
</config>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:a4170319-d410-44bc-86da-7461fc38c790">
    <ok/>
</rpc-reply>

Change The Password Of Local User

Request example to change password of local user via edit-config.

<config>
<top>
    <users>
    <user operation="merge">
        <name>test11</name>
        <password>987654</password>
        <max-session>3</max-session>
    </user>
    </users>
</top>
</config>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:a02b9a72-4c2c-450f-8849-00d04c8440df">
    <ok/>
</rpc-reply>

Get Current Local Users

Request example to get all local user via get-config.

<filter type="subtree">
  <top>
    <users>
    </users>
  </top>
</filter>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:dfd92f28-43c4-4178-adae-f6461d9aaa68">
    <data>
    <top>
        <users xmlns="http://asterfusion.com/ns/yang/asternos-local-user">
            <user>
                <name>admin</name>
                <cipher-password>$y$j9T$39sVyGMRfJ0.dwSB/gEK.0$jD/O9lvXfJYbRrCKPvAWGjibpyCmVW5ex72LyLGfhnA</cipher-password>
                <privilege-level>sys_admin</privilege-level>
            </user>
            <user>
                <name>test11</name>
                <cipher-password>$6$iRjl91bc38ZlZmqk$e2W5mepRdFpozZoRc.17Ssb7hzr1KaxZR66.0kAd4nLNrxumRef1eu3UnYRs34z.Pt1ujUX/uzs8b6iD0Viqz0</cipher-password>
                <privilege-level>none</privilege-level>
                <max-session>3</max-session>
            </user>
            <user>
                <name>test12</name>
                <cipher-password>$6$uC3DoK8V1.4pbLny$unnk201SgTplC8s9Ktz0W6xz6Bd1DgsHZ4G0tErBeZnCiCMKXsWOBkCJLVlD6LFkT7sat5ohQC4wjcFz/2pOi1</cipher-password>
                <privilege-level>config</privilege-level>
            </user>
            <user>
                <name>test13</name>
                <cipher-password>$6$4UH.gouvdHANk93k$/qjWpDV5icZBOxNhnCwnmJNHYw7pcQGtRRhzUhddHJediNeH/cutiqNA2EutQPWTOiZ3vAxlbAkVKdUP.b1Gk1</cipher-password>
                <privilege-level>sys_admin</privilege-level>
            </user>
        </users>
    </top>
</data>
</rpc-reply>

Get Local User Policy

NOTE

The default retry-count is 5, default block-time is 300 seconds, default fail-interval is 60 seconds.

Request example to get local user policy via get-config.

<filter type="subtree">
    <top>
        <local-user-policy>
        </local-user-policy>
    </top>
</filter>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:e3d1c2c1-233a-4b93-ad86-10bd9a4e29ca">
    <data>
        <top>
            <local-user-policy xmlns="http://asterfusion.com/ns/yang/asternos-local-user">
                <retry-count>5</retry-count>
                <block-time>300</block-time>
                <fail-interval>60</fail-interval>
                <max-session>5</max-session>
                <session-timeout>900</session-timeout>
            </local-user-policy>
        </top>
    </data>
</rpc-reply>

Update Local User Policy

Request example to update local user policy via edit-config.

<config>
    <top>
    <local-user-policy operation="merge">
        <block-time>360</block-time>
        <fail-interval>120</fail-interval>
        <retry-count>3</retry-count>
        <max-session>5</max-session>
        <session-timeout>1800</session-timeout>
    </local-user-policy>
    </top>
</config>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:f802f146-d847-4a30-970c-d79a10f7b0aa">
    <ok/>
</rpc-reply>

Remove Local User Policy

NOTE

You can lift the security restrictions on local users by delete the local-user-policy resource.

Request example to delete local user policy via edit-config.

<config>
    <top>
    <local-user-policy operation="delete">
    </local-user-policy>
    </top>
</config>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:b0d79773-a804-4f65-8477-aed47a51167a">
    <ok/>
</rpc-reply>

Get Local Password Policy

NOTE

The default local-password-policy is disabled. local-password-policy doesn’t support delete operation.

Request example to get local user policy via get-config.

<filter type="subtree">
    <top>
        <local-password-policy>
        </local-password-policy>
    </top>
</filter>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:7fb20a34-ed8c-45c9-a88d-7d13621220d0">
    <data>
        <top>
            <local-password-policy xmlns="http://asterfusion.com/ns/yang/asternos-local-user">
                <enabled>false</enabled>
            </local-password-policy>
        </top>
    </data>
</rpc-reply>

Update Local Password Policy

Request example to update local user policy via edit-config.

<config>
<top>
    <local-password-policy operation="merge">
        <enabled>true</enabled>
        <min-len>9</min-len>
    </local-password-policy>
</top>
</config>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:2c283000-462d-4388-8de9-0cc990bd3b88">
    <ok/>
</rpc-reply>

Show Local User Block Configurations

Request example to show local user block configurations via rpc show-users-block-conf.

<show-users-block-conf/>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:17d082ab-c5d8-48a8-a1e9-afd363d743c7">
    <data>
        <local-user-policy>
            <retry-count>3</retry-count>
            <block-time>360</block-time>
            <fail-interval>120</fail-interval>
        </local-user-policy>
    </data>
</rpc-reply>

Shows Information Of Local Users Blocked

Request example to show users blocked via rpc show-users-blocked.

<show-users-blocked/>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:4c1dce48-7990-48e9-ae30-52ad9fa0d551">
    <data xmlns="http://asterfusion.com/ns/yang/asternos-local-user">
    +---------+------------+---------------------+---------------+
    | Login   |   Failures | Latest failure      | From          |
    +=========+============+=====================+===============+
    | test11  |          3 | 2025-09-26 09:14:04 | 192.168.17.96 |
    +---------+------------+---------------------+---------------+
    </data>
</rpc-reply>

Shows Information Of Local Users Blocked

Request example to show users brief via rpc show-users-brief.

<show-users-brief/>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:3f188774-21a8-4ae2-b668-9acb0db396e8">
    <data xmlns="http://asterfusion.com/ns/yang/asternos-local-user">
        +--------+----------+-----------+---------------+--------------+
        | USER   | ONLINE   | BLOCKED   | LOGIN IP      | LOGIN TIME   |
        +========+==========+===========+===============+==============+
        | admin  | yes      | no        | 192.168.17.54 | Sep 28 03:53 |
        +--------+----------+-----------+---------------+--------------+
    </data>
</rpc-reply>

Shows Information Of Local Users Password Control

Request example to show local users password control via rpc show-users-password-control.

<show-users-password-control/>

Response example

<rpc-reply xmlns="urn:ietf:params:xml:ns:netconf:base:1.0" message-id="urn:uuid:6d8b52cd-2859-481f-bee8-c4a476cd5f2c">
    <data>
        <local-password-policy>
            <state>enabled</state>
            <min-len>9</min-len>
            <max-len>20</max-len>
            <min-lowercase>1</min-lowercase>
            <min-uppercase>1</min-uppercase>
            <min-digits>1</min-digits>
            <min-special-chars>1</min-special-chars>
            <max-repeat>1</max-repeat>
            <max-consecutive>1</max-consecutive>
        </local-password-policy>
    </data>
</rpc-reply>

Properties Descriptions

Local user password policy

Tree Diagram

module: asternos-local-user
  +--rw local-password-policy
     +--rw enabled?                   boolean
     +--rw min-len?                   uint8
     +--rw max-len?                   uint8
     +--rw min-lowercase?             class-count
     +--rw min-uppercase?             class-count
     +--rw min-digits?                class-count
     +--rw min-special-chars?         class-count
     +--rw max-repeat?                class-count
     +--rw max-consecutive?           class-count
     +--rw expiration-time?           int16
     +--rw expiration-warning-time?   int8

Table of Properties

Name	Required	Type/Range	Description
local-password-policy	M		Path-only node, has no configurable value. Local user password policy.
enabled	O	”true" "false”	Enable local user password control Default value: False
min-len	O	8..64	Minimum password length for Local users. Default value: 8
max-len	O	8..128	Maximum password length for Local users. Default value: 128
min-lowercase	O	0..10	Minimum lowercase letters for Local users password. Default value: 0
min-uppercase	O	0..10	Minimum uppercase letters for Local users password. Default value: 0
min-digits	O	0..10	Minimum digits for Local users password. Default value: 0
min-special-chars	O	0..10	Minimum special characters for Local users password. Default value: 0
max-repeat	O	0..10	Maximum repeat characters for Local users password. Default value: 0
max-consecutive	O	0..10	Maximum consecutive characters for Local users password. Default value: 0
expiration-time	O	0..365	Password expiration days. 0 means no expiration time.
expiration-warning-time	O	0..30	Prompt password expiration n days in advance. 0 means no expiration warning.

Local user policy

Tree Diagram

module: asternos-local-user
  +--rw local-user-policy
     +--rw retry-count?       uint32
     +--rw block-time?        uint32
     +--rw fail-interval?     uint32
     +--rw max-session?       uint32
     +--rw session-timeout?   uint32

Table of Properties

Name	Required	Type/Range	Description
local-user-policy	M		Path-only node, has no configurable value. Local user policy.
retry-count	O	2..65535	Maximum number of password attempts. Default value: 5
block-time	O	60..65535	The lockout time after the maximum number of incorrect passwords is reached. Default value: 300
fail-interval	O	30..32767	The time window for counting failed password attempts. Default value: 60
max-session	O	1..100	Maximum number of sessions allowed for each local user. Default value: 5
session-timeout	O	60..65535	The time of inactivity after which the session will be automatically logged out. 0 means no timeout. Default value: 900

Local user

Tree Diagram

module: asternos-local-user
  +--rw users
     +--rw user* [name]
        +--rw name               string
        +--rw password?          local-user-secret
        +--rw cipher-password?   local-user-cipher-secret
        +--rw privilege-level?   privilege-level
        +--rw max-session?       uint32

Table of Properties

Name	Required	Type/Range	Description
users	M		Path-only node, has no configurable value. Local user.
user	M		Path-only node, has no configurable value. The list of user in local.
name	O	string	Local user name.
password	O	Local user password, maximum 128 characters, no space characters allowed.	Local user’s password.
cipher-password	O	Local user cipher password or cipher string;	Local user’s cipher password.
privilege-level	O	”none" "show" "config" "sys_admin”	Local user privilege level. Default value: none
max-session	O	1..100	Maximum number of sessions allowed for the local user. Default value: 5

Show Users Block Conf

Tree Diagram

module: asternos-local-user

  rpcs:
    +---x show-users-block-conf
       +--ro output
          +--ro data?   <anydata>

Table of Properties

Name	Required	Type/Range	Description
show-users-block-conf	O
data	O		A table that shows information of local users block conf

Show Users Blocked

Tree Diagram

module: asternos-local-user

  rpcs:
    +---x show-users-blocked
       +--ro output
          +--ro data?   <anydata>

Table of Properties

Name	Required	Type/Range	Description
show-users-blocked	O
data	O		A table that shows information of local users blocked

Show Users Brief

Tree Diagram

module: asternos-local-user

  rpcs:
    +---x show-users-brief
       +--ro output
          +--ro data?   <anydata>

Table of Properties

Name	Required	Type/Range	Description
show-users-brief	O
data	O		A table that shows information of local users brief

Show Users Password Control

Tree Diagram

module: asternos-local-user

  rpcs:
    +---x show-users-password-control
       +--ro output
          +--ro data?   <anydata>

Table of Properties

Name	Required	Type/Range	Description
show-users-password-control	O
data	O		A table that shows information of local users password control

Show Users Session Conf

Tree Diagram

module: asternos-local-user

  rpcs:
    +---x show-users-session-conf
       +--ro output
          +--ro data?   <anydata>

Table of Properties

Name	Required	Type/Range	Description
show-users-session-conf	O
data	O		A table that shows information of local users session config

Unblock Users

Tree Diagram

module: asternos-local-user

  rpcs:
    +---x unblock-users
       +---w input
          +---w name?   local-user-name

Table of Properties

Name	Required	Type/Range	Description
unblock-users	O
name	O	Local user name.	Local user name.