peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-22 09:13:01 +02:00
Code Issues Packages Projects Releases Wiki Activity
Files
03511f18fd28dcd902fe04a12f2b2e416d7253cd
infix/dev/nacm/index.html
T

3564 lines
111 KiB
HTML
Raw Blame History

<!DOCTYPE html><html lang="en" class="no-js"><head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta name="description" content="Infix Documentation">
<link rel="canonical" href="https://kernelkit.github.io/infix/dev/nacm/">
<link rel="prev" href="../system/">
<link rel="next" href="../hardware/">
<link rel="icon" href="../assets/images/favicon.png">
<meta name="generator" content="mkdocs-1.6.1, mkdocs-material-9.7.4">
<title>Access Control (NACM) - User's Guide</title>
<link rel="stylesheet" href="../assets/stylesheets/main.484c7ddc.min.css">
<link rel="stylesheet" href="../assets/stylesheets/palette.ab4e12ef.min.css">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&amp;display=fallback">
<style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style>
<link rel="stylesheet" href="../extra.css">
<script>__md_scope=new URL("..",location),__md_hash=e=>[...e].reduce(((e,_)=>(e<<5)-e+_.charCodeAt(0)),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
<link href="../assets/stylesheets/glightbox.min.css" rel="stylesheet"><script src="../assets/javascripts/glightbox.min.js"></script><style id="glightbox-style">
html.glightbox-open { overflow: initial; height: 100%; }
.gslide-title { margin-top: 0px; user-select: text; }
.gslide-desc { color: #666; user-select: text; }
.gslide-image img { background: black; }
.glightbox-clean .gslide-media { -webkit-box-shadow: none; box-shadow: none; }
.gscrollbar-fixer { padding-right: 15px; }
.gdesc-inner { font-size: 0.75rem; }
body[data-md-color-scheme="slate"] .gdesc-inner { background: var(--md-default-bg-color); }
body[data-md-color-scheme="slate"] .gslide-title { color: var(--md-default-fg-color); }
body[data-md-color-scheme="slate"] .gslide-desc { color: var(--md-default-fg-color); }
</style></head>
<body dir="ltr" data-md-color-scheme="default" data-md-color-primary="orange" data-md-color-accent="orange">
<input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
<input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
<label class="md-overlay" for="__drawer"></label>
<div data-md-component="skip">
<a href="#network-access-control-model-nacm" class="md-skip">
Skip to content
</a>
</div>
<div data-md-component="announce">
</div>
<div data-md-color-scheme="default" data-md-component="outdated" hidden>
</div>
<header class="md-header md-header--shadow" data-md-component="header">
<nav class="md-header__inner md-grid" aria-label="Header">
<a href="https://www.kernelkit.org/" title="User's Guide" class="md-header__button md-logo" aria-label="User's Guide" data-md-component="logo">
<img src="../logo-plain.png" alt="logo">
</a>
<label class="md-header__button md-icon" for="__drawer">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z"></path></svg>
</label>
<div class="md-header__title" data-md-component="header-title">
<div class="md-header__ellipsis">
<div class="md-header__topic">
<span class="md-ellipsis">
User's Guide
</span>
</div>
<div class="md-header__topic" data-md-component="header-topic">
<span class="md-ellipsis">
Access Control (NACM)
</span>
</div>
</div>
</div>
<form class="md-header__option" data-md-component="palette">
<input class="md-option" data-md-color-media="(prefers-color-scheme: light)" data-md-color-scheme="default" data-md-color-primary="orange" data-md-color-accent="orange" aria-label="Switch to dark mode" type="radio" name="__palette" id="__palette_0">
<label class="md-header__button md-icon" title="Switch to dark mode" for="__palette_1" hidden>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="m17.75 4.09-2.53 1.94.91 3.06-2.63-1.81-2.63 1.81.91-3.06-2.53-1.94L12.44 4l1.06-3 1.06 3zm3.5 6.91-1.64 1.25.59 1.98-1.7-1.17-1.7 1.17.59-1.98L15.75 11l2.06-.05L18.5 9l.69 1.95zm-2.28 4.95c.83-.08 1.72 1.1 1.19 1.85-.32.45-.66.87-1.08 1.27C15.17 23 8.84 23 4.94 19.07c-3.91-3.9-3.91-10.24 0-14.14.4-.4.82-.76 1.27-1.08.75-.53 1.93.36 1.85 1.19-.27 2.86.69 5.83 2.89 8.02a9.96 9.96 0 0 0 8.02 2.89m-1.64 2.02a12.08 12.08 0 0 1-7.8-3.47c-2.17-2.19-3.33-5-3.49-7.82-2.81 3.14-2.7 7.96.31 10.98 3.02 3.01 7.84 3.12 10.98.31"></path></svg>
</label>
<input class="md-option" data-md-color-media="(prefers-color-scheme: dark)" data-md-color-scheme="slate" data-md-color-primary="black" data-md-color-accent="orange" aria-label="Switch to light mode" type="radio" name="__palette" id="__palette_1">
<label class="md-header__button md-icon" title="Switch to light mode" for="__palette_0" hidden>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M12 7a5 5 0 0 1 5 5 5 5 0 0 1-5 5 5 5 0 0 1-5-5 5 5 0 0 1 5-5m0 2a3 3 0 0 0-3 3 3 3 0 0 0 3 3 3 3 0 0 0 3-3 3 3 0 0 0-3-3m0-7 2.39 3.42C13.65 5.15 12.84 5 12 5s-1.65.15-2.39.42zM3.34 7l4.16-.35A7.2 7.2 0 0 0 5.94 8.5c-.44.74-.69 1.5-.83 2.29zm.02 10 1.76-3.77a7.131 7.131 0 0 0 2.38 4.14zM20.65 7l-1.77 3.79a7.02 7.02 0 0 0-2.38-4.15zm-.01 10-4.14.36c.59-.51 1.12-1.14 1.54-1.86.42-.73.69-1.5.83-2.29zM12 22l-2.41-3.44c.74.27 1.55.44 2.41.44.82 0 1.63-.17 2.37-.44z"></path></svg>
</label>
</form>
<script>var palette=__md_get("__palette");if(palette&&palette.color){if("(prefers-color-scheme)"===palette.color.media){var media=matchMedia("(prefers-color-scheme: light)"),input=document.querySelector(media.matches?"[data-md-color-media='(prefers-color-scheme: light)']":"[data-md-color-media='(prefers-color-scheme: dark)']");palette.color.media=input.getAttribute("data-md-color-media"),palette.color.scheme=input.getAttribute("data-md-color-scheme"),palette.color.primary=input.getAttribute("data-md-color-primary"),palette.color.accent=input.getAttribute("data-md-color-accent")}for(var[key,value]of Object.entries(palette.color))document.body.setAttribute("data-md-color-"+key,value)}</script>
<label class="md-header__button md-icon" for="__search">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"></path></svg>
</label>
<div class="md-search" data-md-component="search" role="dialog">
<label class="md-search__overlay" for="__search"></label>
<div class="md-search__inner" role="search">
<form class="md-search__form" name="search">
<input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
<label class="md-search__icon md-icon" for="__search">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5"></path></svg>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"></path></svg>
</label>
<nav class="md-search__options" aria-label="Search">
<a href="javascript:void(0)" class="md-search__icon md-icon" title="Share" aria-label="Share" data-clipboard data-clipboard-text="" data-md-component="search-share" tabindex="-1">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M18 16.08c-.76 0-1.44.3-1.96.77L8.91 12.7c.05-.23.09-.46.09-.7s-.04-.47-.09-.7l7.05-4.11c.54.5 1.25.81 2.04.81a3 3 0 0 0 3-3 3 3 0 0 0-3-3 3 3 0 0 0-3 3c0 .24.04.47.09.7L8.04 9.81C7.5 9.31 6.79 9 6 9a3 3 0 0 0-3 3 3 3 0 0 0 3 3c.79 0 1.5-.31 2.04-.81l7.12 4.15c-.05.21-.08.43-.08.66 0 1.61 1.31 2.91 2.92 2.91s2.92-1.3 2.92-2.91A2.92 2.92 0 0 0 18 16.08"></path></svg>
</a>
<button type="reset" class="md-search__icon md-icon" title="Clear" aria-label="Clear" tabindex="-1">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12z"></path></svg>
</button>
</nav>
</form>
<div class="md-search__output">
<div class="md-search__scrollwrap" tabindex="0" data-md-scrollfix>
<div class="md-search-result" data-md-component="search-result">
<div class="md-search-result__meta">
Initializing search
</div>
<ol class="md-search-result__list" role="presentation"></ol>
</div>
</div>
</div>
</div>
</div>
<div class="md-header__source">
<a href="https://github.com/kernelkit/infix/" title="Go to repository" class="md-source" data-md-component="source">
<div class="md-source__icon md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--><path d="M439.6 236.1 244 40.5c-5.4-5.5-12.8-8.5-20.4-8.5s-15 3-20.4 8.4L162.5 81l51.5 51.5c27.1-9.1 52.7 16.8 43.4 43.7l49.7 49.7c34.2-11.8 61.2 31 35.5 56.7-26.5 26.5-70.2-2.9-56-37.3L240.3 199v121.9c25.3 12.5 22.3 41.8 9.1 55-6.4 6.4-15.2 10.1-24.3 10.1s-17.8-3.6-24.3-10.1c-17.6-17.6-11.1-46.9 11.2-56v-123c-20.8-8.5-24.6-30.7-18.6-45L142.6 101 8.5 235.1C3 240.6 0 247.9 0 255.5s3 15 8.5 20.4l195.6 195.7c5.4 5.4 12.7 8.4 20.4 8.4s15-3 20.4-8.4l194.7-194.7c5.4-5.4 8.4-12.8 8.4-20.4s-3-15-8.4-20.4"></path></svg>
</div>
<div class="md-source__repository">
kernelkit/infix
</div>
</a>
</div>
</nav>
</header>
<div class="md-container" data-md-component="container">
<main class="md-main" data-md-component="main">
<div class="md-main__inner md-grid">
<div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation">
<div class="md-sidebar__scrollwrap">
<div class="md-sidebar__inner">
<nav class="md-nav md-nav--primary" aria-label="Navigation" data-md-level="0">
<label class="md-nav__title" for="__drawer">
<a href="https://www.kernelkit.org/" title="User's Guide" class="md-nav__button md-logo" aria-label="User's Guide" data-md-component="logo">
<img src="../logo-plain.png" alt="logo">
</a>
User's Guide
</label>
<div class="md-nav__source">
<a href="https://github.com/kernelkit/infix/" title="Go to repository" class="md-source" data-md-component="source">
<div class="md-source__icon md-icon">
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><!--! Font Awesome Free 7.1.0 by @fontawesome - https://fontawesome.com License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License) Copyright 2025 Fonticons, Inc.--><path d="M439.6 236.1 244 40.5c-5.4-5.5-12.8-8.5-20.4-8.5s-15 3-20.4 8.4L162.5 81l51.5 51.5c27.1-9.1 52.7 16.8 43.4 43.7l49.7 49.7c34.2-11.8 61.2 31 35.5 56.7-26.5 26.5-70.2-2.9-56-37.3L240.3 199v121.9c25.3 12.5 22.3 41.8 9.1 55-6.4 6.4-15.2 10.1-24.3 10.1s-17.8-3.6-24.3-10.1c-17.6-17.6-11.1-46.9 11.2-56v-123c-20.8-8.5-24.6-30.7-18.6-45L142.6 101 8.5 235.1C3 240.6 0 247.9 0 255.5s3 15 8.5 20.4l195.6 195.7c5.4 5.4 12.7 8.4 20.4 8.4s15-3 20.4-8.4l194.7-194.7c5.4-5.4 8.4-12.8 8.4-20.4s-3-15-8.4-20.4"></path></svg>
</div>
<div class="md-source__repository">
kernelkit/infix
</div>
</a>
</div>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href=".." class="md-nav__link">
<span class="md-ellipsis">
Introduction
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_2">
<label class="md-nav__link" for="__nav_2" id="__nav_2_label" tabindex="0">
<span class="md-ellipsis">
CLI
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_2_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_2">
<span class="md-nav__icon md-icon"></span>
CLI
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../cli/introduction/" class="md-nav__link">
<span class="md-ellipsis">
Introduction
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../cli/configure/" class="md-nav__link">
<span class="md-ellipsis">
Configuration
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../cli/keybindings/" class="md-nav__link">
<span class="md-ellipsis">
Keybindings
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../cli/netcalc/" class="md-nav__link">
<span class="md-ellipsis">
Network Calculator
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../cli/tcpdump/" class="md-nav__link">
<span class="md-ellipsis">
Network Monitoring
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../cli/quick/" class="md-nav__link">
<span class="md-ellipsis">
Quickstart Guide
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../cli/text-editor/" class="md-nav__link">
<span class="md-ellipsis">
Text Editor
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../cli/upgrade/" class="md-nav__link">
<span class="md-ellipsis">
Upgrading
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="../container/" class="md-nav__link">
<span class="md-ellipsis">
Docker Containers
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4">
<label class="md-nav__link" for="__nav_4" id="__nav_4_label" tabindex="0">
<span class="md-ellipsis">
Networking
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_4_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_4">
<span class="md-nav__icon md-icon"></span>
Networking
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../networking/" class="md-nav__link">
<span class="md-ellipsis">
Overview
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../iface/" class="md-nav__link">
<span class="md-ellipsis">
Common Settings
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../bridging/" class="md-nav__link">
<span class="md-ellipsis">
Bridging
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../lag/" class="md-nav__link">
<span class="md-ellipsis">
Link Aggregation
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../ethernet/" class="md-nav__link">
<span class="md-ellipsis">
Ethernet Interfaces
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../ip/" class="md-nav__link">
<span class="md-ellipsis">
IP Addressing
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../routing/" class="md-nav__link">
<span class="md-ellipsis">
Routing
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../firewall/" class="md-nav__link">
<span class="md-ellipsis">
Firewall Configuration
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../qos/" class="md-nav__link">
<span class="md-ellipsis">
Quality of Service
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../eth-counters/" class="md-nav__link">
<span class="md-ellipsis">
RMON Counters
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../tunnels/" class="md-nav__link">
<span class="md-ellipsis">
Tunneling (L2/L3)
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_4_12">
<label class="md-nav__link" for="__nav_4_12" id="__nav_4_12_label" tabindex="0">
<span class="md-ellipsis">
VPN Tunnels
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="2" aria-labelledby="__nav_4_12_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_4_12">
<span class="md-nav__icon md-icon"></span>
VPN Tunnels
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../vpn/" class="md-nav__link">
<span class="md-ellipsis">
Overview
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../vpn-wireguard/" class="md-nav__link">
<span class="md-ellipsis">
WireGuard
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="../wifi/" class="md-nav__link">
<span class="md-ellipsis">
Wireless LAN (WiFi)
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5">
<label class="md-nav__link" for="__nav_5" id="__nav_5_label" tabindex="0">
<span class="md-ellipsis">
Services
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_5">
<span class="md-nav__icon md-icon"></span>
Services
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../discovery/" class="md-nav__link">
<span class="md-ellipsis">
Device Discovery
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../dhcp/" class="md-nav__link">
<span class="md-ellipsis">
DHCP Server
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../ntp/" class="md-nav__link">
<span class="md-ellipsis">
NTP Server
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--active md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" checked>
<label class="md-nav__link" for="__nav_6" id="__nav_6_label" tabindex="0">
<span class="md-ellipsis">
System
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="true">
<label class="md-nav__title" for="__nav_6">
<span class="md-nav__icon md-icon"></span>
System
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../boot/" class="md-nav__link">
<span class="md-ellipsis">
Boot Procedure
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../system/" class="md-nav__link">
<span class="md-ellipsis">
Configuration
</span>
</a>
</li>
<li class="md-nav__item md-nav__item--active">
<input class="md-nav__toggle md-toggle" type="checkbox" id="__toc">
<label class="md-nav__link md-nav__link--active" for="__toc">
<span class="md-ellipsis">
Access Control (NACM)
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<a href="./" class="md-nav__link md-nav__link--active">
<span class="md-ellipsis">
Access Control (NACM)
</span>
</a>
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
<label class="md-nav__title" for="__toc">
<span class="md-nav__icon md-icon"></span>
Table of contents
</label>
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
<li class="md-nav__item">
<a href="#tldr-the-factory-defaults-work" class="md-nav__link">
<span class="md-ellipsis">
TL;DR - The Factory Defaults Work
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#overview" class="md-nav__link">
<span class="md-ellipsis">
Overview
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#rule-evaluation" class="md-nav__link">
<span class="md-ellipsis">
Rule Evaluation
</span>
</a>
<nav class="md-nav" aria-label="Rule Evaluation">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#example-rule-evaluation" class="md-nav__link">
<span class="md-ellipsis">
Example Rule Evaluation
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#global-defaults" class="md-nav__link">
<span class="md-ellipsis">
Global Defaults
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#module-name-vs-path" class="md-nav__link">
<span class="md-ellipsis">
Module-Name vs Path
</span>
</a>
<nav class="md-nav" aria-label="Module-Name vs Path">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#module-name-matching" class="md-nav__link">
<span class="md-ellipsis">
Module-Name Matching
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#path-matching" class="md-nav__link">
<span class="md-ellipsis">
Path Matching
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#yang-level-annotations" class="md-nav__link">
<span class="md-ellipsis">
YANG-Level Annotations
</span>
</a>
<nav class="md-nav" aria-label="YANG-Level Annotations">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#nacmdefault-deny-all" class="md-nav__link">
<span class="md-ellipsis">
nacm:default-deny-all
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#nacmdefault-deny-write" class="md-nav__link">
<span class="md-ellipsis">
nacm:default-deny-write
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#protected-operations" class="md-nav__link">
<span class="md-ellipsis">
Protected Operations
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#access-operations" class="md-nav__link">
<span class="md-ellipsis">
Access Operations
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#rule-list-groups" class="md-nav__link">
<span class="md-ellipsis">
Rule-List Groups
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#example-factory-configuration" class="md-nav__link">
<span class="md-ellipsis">
Example: Factory Configuration
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#common-patterns" class="md-nav__link">
<span class="md-ellipsis">
Common Patterns
</span>
</a>
<nav class="md-nav" aria-label="Common Patterns">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#permit-by-default" class="md-nav__link">
<span class="md-ellipsis">
Permit-by-Default
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#deny-by-default" class="md-nav__link">
<span class="md-ellipsis">
Deny-by-Default
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#global-restrictions" class="md-nav__link">
<span class="md-ellipsis">
Global Restrictions
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#debugging-nacm" class="md-nav__link">
<span class="md-ellipsis">
Debugging NACM
</span>
</a>
<nav class="md-nav" aria-label="Debugging NACM">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#viewing-effective-permissions" class="md-nav__link">
<span class="md-ellipsis">
Viewing Effective Permissions
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#testing-access" class="md-nav__link">
<span class="md-ellipsis">
Testing Access
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#nacm-statistics" class="md-nav__link">
<span class="md-ellipsis">
NACM Statistics
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#best-practices" class="md-nav__link">
<span class="md-ellipsis">
Best Practices
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#references" class="md-nav__link">
<span class="md-ellipsis">
References
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="../hardware/" class="md-nav__link">
<span class="md-ellipsis">
Hardware Info &amp; Status
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../management/" class="md-nav__link">
<span class="md-ellipsis">
Management
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../keystore/" class="md-nav__link">
<span class="md-ellipsis">
Keystore
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../syslog/" class="md-nav__link">
<span class="md-ellipsis">
Syslog Support
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../support/" class="md-nav__link">
<span class="md-ellipsis">
Support Data
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../upgrade/" class="md-nav__link">
<span class="md-ellipsis">
Upgrade
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7">
<label class="md-nav__link" for="__nav_7" id="__nav_7_label" tabindex="0">
<span class="md-ellipsis">
Scripting
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_7">
<span class="md-nav__icon md-icon"></span>
Scripting
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../scripting/" class="md-nav__link">
<span class="md-ellipsis">
Introduction
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../scripting-sysrepocfg/" class="md-nav__link">
<span class="md-ellipsis">
Legacy Scripting
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../scripting-netconf/" class="md-nav__link">
<span class="md-ellipsis">
NETCONF Scripting
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../scripting-restconf/" class="md-nav__link">
<span class="md-ellipsis">
RESTCONF Scripting
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../scripting-prod/" class="md-nav__link">
<span class="md-ellipsis">
Production Testing
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item md-nav__item--nested">
<input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_8">
<label class="md-nav__link" for="__nav_8" id="__nav_8_label" tabindex="0">
<span class="md-ellipsis">
Developer's Corner
</span>
<span class="md-nav__icon md-icon"></span>
</label>
<nav class="md-nav" data-md-level="1" aria-labelledby="__nav_8_label" aria-expanded="false">
<label class="md-nav__title" for="__nav_8">
<span class="md-nav__icon md-icon"></span>
Developer's Corner
</label>
<ul class="md-nav__list" data-md-scrollfix>
<li class="md-nav__item">
<a href="../branding/" class="md-nav__link">
<span class="md-ellipsis">
Branding &amp; Releases
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../developers-guide/" class="md-nav__link">
<span class="md-ellipsis">
Developer's Guide
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../override-package/" class="md-nav__link">
<span class="md-ellipsis">
Developing with Buildroot
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../netboot/" class="md-nav__link">
<span class="md-ellipsis">
Netboot HowTo
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../testing/" class="md-nav__link">
<span class="md-ellipsis">
Regression Testing
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../test-arch/" class="md-nav__link">
<span class="md-ellipsis">
Test System Architecture
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../virtual/" class="md-nav__link">
<span class="md-ellipsis">
Virtual Environments
</span>
</a>
</li>
<li class="md-nav__item">
<a href="../vpd/" class="md-nav__link">
<span class="md-ellipsis">
Vital Product Data (VPD)
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="../license/" class="md-nav__link">
<span class="md-ellipsis">
Origin &amp; Licensing
</span>
</a>
</li>
</ul>
</nav>
</div>
</div>
</div>
<div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc">
<div class="md-sidebar__scrollwrap">
<div class="md-sidebar__inner">
<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
<label class="md-nav__title" for="__toc">
<span class="md-nav__icon md-icon"></span>
Table of contents
</label>
<ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
<li class="md-nav__item">
<a href="#tldr-the-factory-defaults-work" class="md-nav__link">
<span class="md-ellipsis">
TL;DR - The Factory Defaults Work
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#overview" class="md-nav__link">
<span class="md-ellipsis">
Overview
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#rule-evaluation" class="md-nav__link">
<span class="md-ellipsis">
Rule Evaluation
</span>
</a>
<nav class="md-nav" aria-label="Rule Evaluation">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#example-rule-evaluation" class="md-nav__link">
<span class="md-ellipsis">
Example Rule Evaluation
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#global-defaults" class="md-nav__link">
<span class="md-ellipsis">
Global Defaults
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#module-name-vs-path" class="md-nav__link">
<span class="md-ellipsis">
Module-Name vs Path
</span>
</a>
<nav class="md-nav" aria-label="Module-Name vs Path">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#module-name-matching" class="md-nav__link">
<span class="md-ellipsis">
Module-Name Matching
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#path-matching" class="md-nav__link">
<span class="md-ellipsis">
Path Matching
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#yang-level-annotations" class="md-nav__link">
<span class="md-ellipsis">
YANG-Level Annotations
</span>
</a>
<nav class="md-nav" aria-label="YANG-Level Annotations">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#nacmdefault-deny-all" class="md-nav__link">
<span class="md-ellipsis">
nacm:default-deny-all
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#nacmdefault-deny-write" class="md-nav__link">
<span class="md-ellipsis">
nacm:default-deny-write
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#protected-operations" class="md-nav__link">
<span class="md-ellipsis">
Protected Operations
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#access-operations" class="md-nav__link">
<span class="md-ellipsis">
Access Operations
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#rule-list-groups" class="md-nav__link">
<span class="md-ellipsis">
Rule-List Groups
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#example-factory-configuration" class="md-nav__link">
<span class="md-ellipsis">
Example: Factory Configuration
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#common-patterns" class="md-nav__link">
<span class="md-ellipsis">
Common Patterns
</span>
</a>
<nav class="md-nav" aria-label="Common Patterns">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#permit-by-default" class="md-nav__link">
<span class="md-ellipsis">
Permit-by-Default
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#deny-by-default" class="md-nav__link">
<span class="md-ellipsis">
Deny-by-Default
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#global-restrictions" class="md-nav__link">
<span class="md-ellipsis">
Global Restrictions
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#debugging-nacm" class="md-nav__link">
<span class="md-ellipsis">
Debugging NACM
</span>
</a>
<nav class="md-nav" aria-label="Debugging NACM">
<ul class="md-nav__list">
<li class="md-nav__item">
<a href="#viewing-effective-permissions" class="md-nav__link">
<span class="md-ellipsis">
Viewing Effective Permissions
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#testing-access" class="md-nav__link">
<span class="md-ellipsis">
Testing Access
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#nacm-statistics" class="md-nav__link">
<span class="md-ellipsis">
NACM Statistics
</span>
</a>
</li>
</ul>
</nav>
</li>
<li class="md-nav__item">
<a href="#best-practices" class="md-nav__link">
<span class="md-ellipsis">
Best Practices
</span>
</a>
</li>
<li class="md-nav__item">
<a href="#references" class="md-nav__link">
<span class="md-ellipsis">
References
</span>
</a>
</li>
</ul>
</nav>
</div>
</div>
</div>
<div class="md-content" data-md-component="content">
<nav class="md-path" aria-label="Navigation">
<ol class="md-path__list">
<li class="md-path__item">
<a href=".." class="md-path__link">
<span class="md-ellipsis">
Introduction
</span>
</a>
</li>
<li class="md-path__item">
<a href="../boot/" class="md-path__link">
<span class="md-ellipsis">
System
</span>
</a>
</li>
</ol>
</nav>
<article class="md-content__inner md-typeset">
<h1 id="network-access-control-model-nacm">Network Access Control Model (NACM)<a class="headerlink" href="#network-access-control-model-nacm" title="Permanent link"></a></h1>
<p>NETCONF Access Control Model (<a href="https://www.rfc-editor.org/rfc/rfc8341">RFC 8341</a>) provides fine-grained access
control for YANG data models. NACM controls who can read, write, and
execute operations on specific parts of the configuration and operational
state.</p>
<p>This document provides technical details about how NACM works, how rules
are evaluated, and best practices for creating custom access control
policies.</p>
<div class="admonition tip">
<p class="admonition-title">Tip</p>
<p>For a practical introduction to user management and the built-in user
levels (admin, operator, guest), see the <a href="../system/#multiple-users">Multiple Users</a> section
in the System Configuration guide.</p>
</div>
<h2 id="tldr-the-factory-defaults-work">TL;DR - The Factory Defaults Work<a class="headerlink" href="#tldr-the-factory-defaults-work" title="Permanent link"></a></h2>
<p><strong>You don't need to understand NACM to use the system securely.</strong></p>
<p>The factory configuration implements a "permit by default, deny sensitive
items" policy that provides:</p>
<ul>
<li><strong>Immediate usability</strong> - Operators can configure the entire system
without custom NACM rules</li>
<li><strong>Automatic security</strong> - Passwords, cryptographic keys, and dangerous
operations are protected out-of-the-box</li>
<li><strong>Future-proof design</strong> - New features work immediately without NACM
updates</li>
</ul>
<p>The three built-in user levels (admin, operator, guest) cover most use
cases. Only read on if you need to create custom access control policies.</p>
<h2 id="overview">Overview<a class="headerlink" href="#overview" title="Permanent link"></a></h2>
<p>NACM provides three types of access control:</p>
<ul>
<li><strong>Data node access</strong> - Control read/write access to configuration and state</li>
<li><strong>Operation access</strong> - Control execution of RPCs (remote procedure calls)</li>
<li><strong>Notification access</strong> - Control subscription to event notifications (not covered here)</li>
</ul>
<p>Access is controlled through:</p>
<ol>
<li><strong>Global defaults</strong> - Default permissions for read/write/exec</li>
<li><strong>YANG-level annotations</strong> - Security markers in YANG modules (see below)</li>
<li><strong>NACM rules</strong> - Explicit permit/deny rules organized in rule-lists</li>
</ol>
<h2 id="rule-evaluation">Rule Evaluation<a class="headerlink" href="#rule-evaluation" title="Permanent link"></a></h2>
<p>NACM rules are evaluated in a specific order:</p>
<ol>
<li><strong>Rule-lists are processed sequentially</strong> in the order they appear in the configuration</li>
<li><strong>Within each rule-list</strong>, rules are evaluated sequentially</li>
<li><strong>First matching rule wins</strong> - no further rules are evaluated</li>
<li><strong>If no rule matches</strong>, global defaults apply (read-default, write-default, exec-default)</li>
<li><strong>YANG annotations override everything</strong> - <code>nacm:default-deny-all</code> in a YANG module requires an explicit permit rule regardless of global defaults</li>
</ol>
<h3 id="example-rule-evaluation">Example Rule Evaluation<a class="headerlink" href="#example-rule-evaluation" title="Permanent link"></a></h3>
<p>Given this configuration:</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-0-1" name="__codelineno-0-1" href="#__codelineno-0-1"></a><span class="p">{</span>
<a id="__codelineno-0-2" name="__codelineno-0-2" href="#__codelineno-0-2"></a><span class="w"> </span><span class="nt">"read-default"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span><span class="p">,</span>
<a id="__codelineno-0-3" name="__codelineno-0-3" href="#__codelineno-0-3"></a><span class="w"> </span><span class="nt">"write-default"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span><span class="p">,</span>
<a id="__codelineno-0-4" name="__codelineno-0-4" href="#__codelineno-0-4"></a><span class="w"> </span><span class="nt">"rule-list"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-0-5" name="__codelineno-0-5" href="#__codelineno-0-5"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-0-6" name="__codelineno-0-6" href="#__codelineno-0-6"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"operator-acl"</span><span class="p">,</span>
<a id="__codelineno-0-7" name="__codelineno-0-7" href="#__codelineno-0-7"></a><span class="w"> </span><span class="nt">"group"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">"operator"</span><span class="p">],</span>
<a id="__codelineno-0-8" name="__codelineno-0-8" href="#__codelineno-0-8"></a><span class="w"> </span><span class="nt">"rule"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-0-9" name="__codelineno-0-9" href="#__codelineno-0-9"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-0-10" name="__codelineno-0-10" href="#__codelineno-0-10"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit-system-rpcs"</span><span class="p">,</span>
<a id="__codelineno-0-11" name="__codelineno-0-11" href="#__codelineno-0-11"></a><span class="w"> </span><span class="nt">"module-name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"ietf-system"</span><span class="p">,</span>
<a id="__codelineno-0-12" name="__codelineno-0-12" href="#__codelineno-0-12"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"exec"</span><span class="p">,</span>
<a id="__codelineno-0-13" name="__codelineno-0-13" href="#__codelineno-0-13"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span>
<a id="__codelineno-0-14" name="__codelineno-0-14" href="#__codelineno-0-14"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-0-15" name="__codelineno-0-15" href="#__codelineno-0-15"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-0-16" name="__codelineno-0-16" href="#__codelineno-0-16"></a><span class="w"> </span><span class="p">},</span>
<a id="__codelineno-0-17" name="__codelineno-0-17" href="#__codelineno-0-17"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-0-18" name="__codelineno-0-18" href="#__codelineno-0-18"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"default-deny-all"</span><span class="p">,</span>
<a id="__codelineno-0-19" name="__codelineno-0-19" href="#__codelineno-0-19"></a><span class="w"> </span><span class="nt">"group"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">"*"</span><span class="p">],</span>
<a id="__codelineno-0-20" name="__codelineno-0-20" href="#__codelineno-0-20"></a><span class="w"> </span><span class="nt">"rule"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-0-21" name="__codelineno-0-21" href="#__codelineno-0-21"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-0-22" name="__codelineno-0-22" href="#__codelineno-0-22"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny-passwords"</span><span class="p">,</span>
<a id="__codelineno-0-23" name="__codelineno-0-23" href="#__codelineno-0-23"></a><span class="w"> </span><span class="nt">"path"</span><span class="p">:</span><span class="w"> </span><span class="s2">"/ietf-system:system/authentication/user/password"</span><span class="p">,</span>
<a id="__codelineno-0-24" name="__codelineno-0-24" href="#__codelineno-0-24"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-0-25" name="__codelineno-0-25" href="#__codelineno-0-25"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny"</span>
<a id="__codelineno-0-26" name="__codelineno-0-26" href="#__codelineno-0-26"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-0-27" name="__codelineno-0-27" href="#__codelineno-0-27"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-0-28" name="__codelineno-0-28" href="#__codelineno-0-28"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-0-29" name="__codelineno-0-29" href="#__codelineno-0-29"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-0-30" name="__codelineno-0-30" href="#__codelineno-0-30"></a><span class="p">}</span>
</code></pre></div>
<p>When operator user "jacky" tries to:</p>
<ul>
<li><strong>Read password</strong>: Matches "deny-passwords" → <strong>DENIED</strong></li>
<li><strong>Write interface config</strong>: No match, uses write-default → <strong>PERMITTED</strong> (write-default=permit)</li>
<li><strong>Write hostname</strong>: No match, uses write-default → <strong>PERMITTED</strong> (write-default=permit)</li>
<li><strong>Reboot system</strong>: Matches "permit-system-rpcs" → <strong>PERMITTED</strong> (overrides <code>nacm:default-deny-all</code>)</li>
</ul>
<h2 id="global-defaults">Global Defaults<a class="headerlink" href="#global-defaults" title="Permanent link"></a></h2>
<p>NACM has three global defaults that apply when no rule matches:</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-1-1" name="__codelineno-1-1" href="#__codelineno-1-1"></a><span class="p">{</span>
<a id="__codelineno-1-2" name="__codelineno-1-2" href="#__codelineno-1-2"></a><span class="w"> </span><span class="nt">"read-default"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span><span class="p">,</span>
<a id="__codelineno-1-3" name="__codelineno-1-3" href="#__codelineno-1-3"></a><span class="w"> </span><span class="nt">"write-default"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span><span class="p">,</span>
<a id="__codelineno-1-4" name="__codelineno-1-4" href="#__codelineno-1-4"></a><span class="w"> </span><span class="nt">"exec-default"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span>
<a id="__codelineno-1-5" name="__codelineno-1-5" href="#__codelineno-1-5"></a><span class="p">}</span>
</code></pre></div>
<p><strong>Factory configuration defaults:</strong></p>
<ul>
<li><code>read-default: "permit"</code> - Users can read configuration and state by default</li>
<li><code>write-default: "permit"</code> - Users can modify configuration by default</li>
<li><code>exec-default: "permit"</code> - Users can execute RPCs by default</li>
</ul>
<p>This permit-by-default approach, combined with targeted denials for
sensitive items (passwords, cryptographic keys), provides a balance
between usability and security. It also makes the system "future proof" -
when new YANG modules are added, operators can immediately configure them
without updating NACM rules.</p>
<div class="admonition tip">
<p class="admonition-title">Important</p>
<p>YANG modules with <code>nacm:default-deny-all</code> or <code>nacm:default-deny-write</code>
annotations override these global defaults. You must create explicit
permit rules for those operations.</p>
</div>
<h2 id="module-name-vs-path">Module-Name vs Path<a class="headerlink" href="#module-name-vs-path" title="Permanent link"></a></h2>
<p>NACM rules can match operations using either <code>module-name</code> or <code>path</code>.
The following sub-sections provide detailed information and examples of
both.</p>
<h3 id="module-name-matching">Module-Name Matching<a class="headerlink" href="#module-name-matching" title="Permanent link"></a></h3>
<p>Matches all nodes <strong>defined</strong> in a specific YANG module:</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-2-1" name="__codelineno-2-1" href="#__codelineno-2-1"></a><span class="p">{</span>
<a id="__codelineno-2-2" name="__codelineno-2-2" href="#__codelineno-2-2"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit-keystore"</span><span class="p">,</span>
<a id="__codelineno-2-3" name="__codelineno-2-3" href="#__codelineno-2-3"></a><span class="w"> </span><span class="nt">"module-name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"ietf-keystore"</span><span class="p">,</span>
<a id="__codelineno-2-4" name="__codelineno-2-4" href="#__codelineno-2-4"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-2-5" name="__codelineno-2-5" href="#__codelineno-2-5"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span>
<a id="__codelineno-2-6" name="__codelineno-2-6" href="#__codelineno-2-6"></a><span class="p">}</span>
</code></pre></div>
<p>This permits all operations on data <strong>defined</strong> in ietf-keystore, but does
NOT cover augments from other modules.</p>
<p><strong>Example:</strong> The <code>/interfaces/interface/ipv4/address</code> path:</p>
<ul>
<li>Interface is defined in <code>ietf-interfaces</code></li>
<li>IPv4 config is defined in <code>ietf-ip</code> (augments ietf-interfaces)</li>
<li>A rule with <code>module-name: "ietf-interfaces"</code> does NOT cover ipv4/address</li>
</ul>
<h3 id="path-matching">Path Matching<a class="headerlink" href="#path-matching" title="Permanent link"></a></h3>
<p>Matches a specific data tree path and <strong>all nodes under it</strong>, including
augments from other modules:</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-3-1" name="__codelineno-3-1" href="#__codelineno-3-1"></a><span class="p">{</span>
<a id="__codelineno-3-2" name="__codelineno-3-2" href="#__codelineno-3-2"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit-network-config"</span><span class="p">,</span>
<a id="__codelineno-3-3" name="__codelineno-3-3" href="#__codelineno-3-3"></a><span class="w"> </span><span class="nt">"path"</span><span class="p">:</span><span class="w"> </span><span class="s2">"/ietf-interfaces:interfaces/interface"</span><span class="p">,</span>
<a id="__codelineno-3-4" name="__codelineno-3-4" href="#__codelineno-3-4"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-3-5" name="__codelineno-3-5" href="#__codelineno-3-5"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span>
<a id="__codelineno-3-6" name="__codelineno-3-6" href="#__codelineno-3-6"></a><span class="p">}</span>
</code></pre></div>
<p>This permits operations on <code>/interfaces/interface</code> <strong>and all child nodes</strong>,
including augments like:</p>
<ul>
<li><code>/interfaces/interface/ipv4</code> (from ietf-ip)</li>
<li><code>/interfaces/interface/ipv6</code> (from ietf-ip)</li>
<li><code>/interfaces/interface/bridge-port</code> (from infix-interfaces)</li>
</ul>
<p><strong>Path syntax:</strong></p>
<ul>
<li>
<p>When used <strong>with</strong> module-name: Path is module-relative (no prefix)</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-4-1" name="__codelineno-4-1" href="#__codelineno-4-1"></a><span class="nt">"module-name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"ietf-system"</span><span class="p">,</span>
<a id="__codelineno-4-2" name="__codelineno-4-2" href="#__codelineno-4-2"></a><span class="nt">"path"</span><span class="p">:</span><span class="w"> </span><span class="s2">"/system/authentication/user/password"</span>
</code></pre></div>
</li>
<li>
<p>When used <strong>without</strong> module-name: Path must include module prefix</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-5-1" name="__codelineno-5-1" href="#__codelineno-5-1"></a><span class="nt">"path"</span><span class="p">:</span><span class="w"> </span><span class="s2">"/ietf-system:system/authentication/user/password"</span>
</code></pre></div>
</li>
</ul>
<div class="admonition tip">
<p class="admonition-title">Use path-based rules</p>
<p>When you want to permit/deny access to a configuration subtree
including all augments, e.g., all IP settings below
<code>/ietf-interfaces:interfaces/</code>. This is more flexible and requires
less maintenance as new features are added.</p>
</div>
<h2 id="yang-level-annotations">YANG-Level Annotations<a class="headerlink" href="#yang-level-annotations" title="Permanent link"></a></h2>
<p>Many YANG modules include NACM annotations that provide baseline security:</p>
<h3 id="nacmdefault-deny-all">nacm:default-deny-all<a class="headerlink" href="#nacmdefault-deny-all" title="Permanent link"></a></h3>
<p>Requires an explicit permit rule, regardless of global defaults:</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-6-1" name="__codelineno-6-1" href="#__codelineno-6-1"></a><span class="k">rpc</span><span class="w"> </span><span class="nv">system-restart</span><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-6-2" name="__codelineno-6-2" href="#__codelineno-6-2"></a><span class="w"> </span><span class="nn">nacm</span><span class="p">:</span><span class="nv">default-deny-all</span><span class="p">;</span>
<a id="__codelineno-6-3" name="__codelineno-6-3" href="#__codelineno-6-3"></a><span class="w"> </span><span class="k">description</span><span class="w"> </span><span class="s2">"Restart the system"</span><span class="p">;</span>
<a id="__codelineno-6-4" name="__codelineno-6-4" href="#__codelineno-6-4"></a><span class="p">}</span>
</code></pre></div>
<p>Even with <code>exec-default: "permit"</code>, users need an explicit permit rule to
execute system-restart.</p>
<h3 id="nacmdefault-deny-write">nacm:default-deny-write<a class="headerlink" href="#nacmdefault-deny-write" title="Permanent link"></a></h3>
<p>Write operations require an explicit permit rule:</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-7-1" name="__codelineno-7-1" href="#__codelineno-7-1"></a><span class="k">container</span><span class="w"> </span><span class="nv">authentication</span><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-7-2" name="__codelineno-7-2" href="#__codelineno-7-2"></a><span class="w"> </span><span class="nn">nacm</span><span class="p">:</span><span class="nv">default-deny-write</span><span class="p">;</span>
<a id="__codelineno-7-3" name="__codelineno-7-3" href="#__codelineno-7-3"></a><span class="w"> </span><span class="k">description</span><span class="w"> </span><span class="s2">"User authentication configuration"</span><span class="p">;</span>
<a id="__codelineno-7-4" name="__codelineno-7-4" href="#__codelineno-7-4"></a><span class="p">}</span>
</code></pre></div>
<p>Even with <code>write-default: "permit"</code>, users need an explicit permit rule to
modify authentication settings.</p>
<h3 id="protected-operations">Protected Operations<a class="headerlink" href="#protected-operations" title="Permanent link"></a></h3>
<p>The following are protected by YANG annotations and require explicit permits:</p>
<p><strong>RPC Operations:</strong></p>
<ul>
<li><code>ietf-system:system-restart</code> (<a href="https://www.rfc-editor.org/rfc/rfc7317">ietf-system</a>)</li>
<li><code>ietf-system:system-shutdown</code> (<a href="https://www.rfc-editor.org/rfc/rfc7317">ietf-system</a>)</li>
<li><code>ietf-system:set-current-datetime</code> (<a href="https://www.rfc-editor.org/rfc/rfc7317">ietf-system</a>)</li>
<li><code>infix-factory-default:factory-default</code></li>
<li><code>ietf-factory-default:factory-reset</code> (<a href="https://www.rfc-editor.org/rfc/rfc8808">RFC 8808</a>)</li>
<li><code>infix-system-software:install-bundle</code></li>
<li><code>infix-system-software:set-boot-order</code></li>
</ul>
<p><strong>Data Containers:</strong></p>
<ul>
<li><code>/system/authentication</code> (<code>nacm:default-deny-write</code>, <a href="https://www.rfc-editor.org/rfc/rfc7317">ietf-system</a>)</li>
<li><code>/nacm</code> (<code>nacm:default-deny-all</code>, <a href="https://www.rfc-editor.org/rfc/rfc8341">RFC 8341</a>)</li>
<li>Routing protocol key chains (<a href="https://www.rfc-editor.org/rfc/rfc8177">ietf-key-chain</a>)</li>
<li>RADIUS shared secrets (<a href="https://www.rfc-editor.org/rfc/rfc7317">ietf-system</a>)</li>
<li>TLS client/server credentials (<a href="https://datatracker.ietf.org/doc/html/draft-ietf-netconf-tls-client-server">ietf-tls-client</a>)</li>
</ul>
<p>This provides defense-in-depth - even if NACM rules are misconfigured, these
critical operations remain protected.</p>
<h2 id="access-operations">Access Operations<a class="headerlink" href="#access-operations" title="Permanent link"></a></h2>
<p>NACM supports the following access operations:</p>
<ul>
<li><code>create</code> - Create new data nodes</li>
<li><code>read</code> - Read existing data nodes</li>
<li><code>update</code> - Modify existing data nodes</li>
<li><code>delete</code> - Delete data nodes</li>
<li><code>exec</code> - Execute RPC operations</li>
<li><code>*</code> - All operations (wildcard)</li>
</ul>
<p><strong>Common combinations:</strong></p>
<ul>
<li><code>"create update delete"</code> - All write operations</li>
<li><code>"*"</code> - Everything (read, write, execute)</li>
<li><code>"read"</code> - Read-only access</li>
</ul>
<h2 id="rule-list-groups">Rule-List Groups<a class="headerlink" href="#rule-list-groups" title="Permanent link"></a></h2>
<p>Each rule-list applies to one or more user groups:</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-8-1" name="__codelineno-8-1" href="#__codelineno-8-1"></a><span class="p">{</span>
<a id="__codelineno-8-2" name="__codelineno-8-2" href="#__codelineno-8-2"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"operator-acl"</span><span class="p">,</span>
<a id="__codelineno-8-3" name="__codelineno-8-3" href="#__codelineno-8-3"></a><span class="w"> </span><span class="nt">"group"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">"operator"</span><span class="p">],</span>
<a id="__codelineno-8-4" name="__codelineno-8-4" href="#__codelineno-8-4"></a><span class="w"> </span><span class="nt">"rule"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="err">...</span><span class="p">]</span>
<a id="__codelineno-8-5" name="__codelineno-8-5" href="#__codelineno-8-5"></a><span class="p">}</span>
</code></pre></div>
<p><strong>Special group names:</strong></p>
<ul>
<li><code>"*"</code> - Matches all users (including those not in any NACM group)</li>
</ul>
<p><strong>Evaluation:</strong>
A user can be in multiple NACM groups. All rule-lists matching the user's
groups are evaluated in order until a matching rule is found.</p>
<h2 id="example-factory-configuration">Example: Factory Configuration<a class="headerlink" href="#example-factory-configuration" title="Permanent link"></a></h2>
<p>The factory configuration uses a "permit by default, deny sensitive items"
approach. This design is "future proof" - when new YANG modules are added,
operators can immediately configure them without updating NACM rules.</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-9-1" name="__codelineno-9-1" href="#__codelineno-9-1"></a><span class="p">{</span>
<a id="__codelineno-9-2" name="__codelineno-9-2" href="#__codelineno-9-2"></a><span class="w"> </span><span class="nt">"ietf-netconf-acm:nacm"</span><span class="p">:</span><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-9-3" name="__codelineno-9-3" href="#__codelineno-9-3"></a><span class="w"> </span><span class="nt">"enable-nacm"</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="p">,</span>
<a id="__codelineno-9-4" name="__codelineno-9-4" href="#__codelineno-9-4"></a><span class="w"> </span><span class="nt">"read-default"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span><span class="p">,</span>
<a id="__codelineno-9-5" name="__codelineno-9-5" href="#__codelineno-9-5"></a><span class="w"> </span><span class="nt">"write-default"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span><span class="p">,</span>
<a id="__codelineno-9-6" name="__codelineno-9-6" href="#__codelineno-9-6"></a><span class="w"> </span><span class="nt">"exec-default"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span><span class="p">,</span>
<a id="__codelineno-9-7" name="__codelineno-9-7" href="#__codelineno-9-7"></a><span class="w"> </span><span class="nt">"groups"</span><span class="p">:</span><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-9-8" name="__codelineno-9-8" href="#__codelineno-9-8"></a><span class="w"> </span><span class="nt">"group"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-9-9" name="__codelineno-9-9" href="#__codelineno-9-9"></a><span class="w"> </span><span class="p">{</span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"admin"</span><span class="p">,</span><span class="w"> </span><span class="nt">"user-name"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">"admin"</span><span class="p">]},</span>
<a id="__codelineno-9-10" name="__codelineno-9-10" href="#__codelineno-9-10"></a><span class="w"> </span><span class="p">{</span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"operator"</span><span class="p">,</span><span class="w"> </span><span class="nt">"user-name"</span><span class="p">:</span><span class="w"> </span><span class="p">[]},</span>
<a id="__codelineno-9-11" name="__codelineno-9-11" href="#__codelineno-9-11"></a><span class="w"> </span><span class="p">{</span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"guest"</span><span class="p">,</span><span class="w"> </span><span class="nt">"user-name"</span><span class="p">:</span><span class="w"> </span><span class="p">[]}</span>
<a id="__codelineno-9-12" name="__codelineno-9-12" href="#__codelineno-9-12"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-9-13" name="__codelineno-9-13" href="#__codelineno-9-13"></a><span class="w"> </span><span class="p">},</span>
<a id="__codelineno-9-14" name="__codelineno-9-14" href="#__codelineno-9-14"></a><span class="w"> </span><span class="nt">"rule-list"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-9-15" name="__codelineno-9-15" href="#__codelineno-9-15"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-9-16" name="__codelineno-9-16" href="#__codelineno-9-16"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"admin-acl"</span><span class="p">,</span>
<a id="__codelineno-9-17" name="__codelineno-9-17" href="#__codelineno-9-17"></a><span class="w"> </span><span class="nt">"group"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">"admin"</span><span class="p">],</span>
<a id="__codelineno-9-18" name="__codelineno-9-18" href="#__codelineno-9-18"></a><span class="w"> </span><span class="nt">"rule"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-9-19" name="__codelineno-9-19" href="#__codelineno-9-19"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-9-20" name="__codelineno-9-20" href="#__codelineno-9-20"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit-all"</span><span class="p">,</span>
<a id="__codelineno-9-21" name="__codelineno-9-21" href="#__codelineno-9-21"></a><span class="w"> </span><span class="nt">"module-name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-9-22" name="__codelineno-9-22" href="#__codelineno-9-22"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-9-23" name="__codelineno-9-23" href="#__codelineno-9-23"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span><span class="p">,</span>
<a id="__codelineno-9-24" name="__codelineno-9-24" href="#__codelineno-9-24"></a><span class="w"> </span><span class="nt">"comment"</span><span class="p">:</span><span class="w"> </span><span class="s2">"Admin has full unrestricted access"</span>
<a id="__codelineno-9-25" name="__codelineno-9-25" href="#__codelineno-9-25"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-9-26" name="__codelineno-9-26" href="#__codelineno-9-26"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-9-27" name="__codelineno-9-27" href="#__codelineno-9-27"></a><span class="w"> </span><span class="p">},</span>
<a id="__codelineno-9-28" name="__codelineno-9-28" href="#__codelineno-9-28"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-9-29" name="__codelineno-9-29" href="#__codelineno-9-29"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"operator-acl"</span><span class="p">,</span>
<a id="__codelineno-9-30" name="__codelineno-9-30" href="#__codelineno-9-30"></a><span class="w"> </span><span class="nt">"group"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">"operator"</span><span class="p">],</span>
<a id="__codelineno-9-31" name="__codelineno-9-31" href="#__codelineno-9-31"></a><span class="w"> </span><span class="nt">"rule"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-9-32" name="__codelineno-9-32" href="#__codelineno-9-32"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-9-33" name="__codelineno-9-33" href="#__codelineno-9-33"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit-system-rpcs"</span><span class="p">,</span>
<a id="__codelineno-9-34" name="__codelineno-9-34" href="#__codelineno-9-34"></a><span class="w"> </span><span class="nt">"module-name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"ietf-system"</span><span class="p">,</span>
<a id="__codelineno-9-35" name="__codelineno-9-35" href="#__codelineno-9-35"></a><span class="w"> </span><span class="nt">"rpc-name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-9-36" name="__codelineno-9-36" href="#__codelineno-9-36"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"exec"</span><span class="p">,</span>
<a id="__codelineno-9-37" name="__codelineno-9-37" href="#__codelineno-9-37"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span><span class="p">,</span>
<a id="__codelineno-9-38" name="__codelineno-9-38" href="#__codelineno-9-38"></a><span class="w"> </span><span class="nt">"comment"</span><span class="p">:</span><span class="w"> </span><span class="s2">"Operators can reboot, shutdown, and set system time"</span>
<a id="__codelineno-9-39" name="__codelineno-9-39" href="#__codelineno-9-39"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-9-40" name="__codelineno-9-40" href="#__codelineno-9-40"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-9-41" name="__codelineno-9-41" href="#__codelineno-9-41"></a><span class="w"> </span><span class="p">},</span>
<a id="__codelineno-9-42" name="__codelineno-9-42" href="#__codelineno-9-42"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-9-43" name="__codelineno-9-43" href="#__codelineno-9-43"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"guest-acl"</span><span class="p">,</span>
<a id="__codelineno-9-44" name="__codelineno-9-44" href="#__codelineno-9-44"></a><span class="w"> </span><span class="nt">"group"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">"guest"</span><span class="p">],</span>
<a id="__codelineno-9-45" name="__codelineno-9-45" href="#__codelineno-9-45"></a><span class="w"> </span><span class="nt">"rule"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-9-46" name="__codelineno-9-46" href="#__codelineno-9-46"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-9-47" name="__codelineno-9-47" href="#__codelineno-9-47"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny-all-write+exec"</span><span class="p">,</span>
<a id="__codelineno-9-48" name="__codelineno-9-48" href="#__codelineno-9-48"></a><span class="w"> </span><span class="nt">"module-name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-9-49" name="__codelineno-9-49" href="#__codelineno-9-49"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"create update delete exec"</span><span class="p">,</span>
<a id="__codelineno-9-50" name="__codelineno-9-50" href="#__codelineno-9-50"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny"</span><span class="p">,</span>
<a id="__codelineno-9-51" name="__codelineno-9-51" href="#__codelineno-9-51"></a><span class="w"> </span><span class="nt">"comment"</span><span class="p">:</span><span class="w"> </span><span class="s2">"Guests can only read, not modify or execute"</span>
<a id="__codelineno-9-52" name="__codelineno-9-52" href="#__codelineno-9-52"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-9-53" name="__codelineno-9-53" href="#__codelineno-9-53"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-9-54" name="__codelineno-9-54" href="#__codelineno-9-54"></a><span class="w"> </span><span class="p">},</span>
<a id="__codelineno-9-55" name="__codelineno-9-55" href="#__codelineno-9-55"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-9-56" name="__codelineno-9-56" href="#__codelineno-9-56"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"default-deny-all"</span><span class="p">,</span>
<a id="__codelineno-9-57" name="__codelineno-9-57" href="#__codelineno-9-57"></a><span class="w"> </span><span class="nt">"group"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">"*"</span><span class="p">],</span>
<a id="__codelineno-9-58" name="__codelineno-9-58" href="#__codelineno-9-58"></a><span class="w"> </span><span class="nt">"rule"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-9-59" name="__codelineno-9-59" href="#__codelineno-9-59"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-9-60" name="__codelineno-9-60" href="#__codelineno-9-60"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny-password-access"</span><span class="p">,</span>
<a id="__codelineno-9-61" name="__codelineno-9-61" href="#__codelineno-9-61"></a><span class="w"> </span><span class="nt">"path"</span><span class="p">:</span><span class="w"> </span><span class="s2">"/ietf-system:system/authentication/user/password"</span><span class="p">,</span>
<a id="__codelineno-9-62" name="__codelineno-9-62" href="#__codelineno-9-62"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-9-63" name="__codelineno-9-63" href="#__codelineno-9-63"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny"</span><span class="p">,</span>
<a id="__codelineno-9-64" name="__codelineno-9-64" href="#__codelineno-9-64"></a><span class="w"> </span><span class="nt">"comment"</span><span class="p">:</span><span class="w"> </span><span class="s2">"No user except admins can access password hashes"</span>
<a id="__codelineno-9-65" name="__codelineno-9-65" href="#__codelineno-9-65"></a><span class="w"> </span><span class="p">},</span>
<a id="__codelineno-9-66" name="__codelineno-9-66" href="#__codelineno-9-66"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-9-67" name="__codelineno-9-67" href="#__codelineno-9-67"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny-keystore-access"</span><span class="p">,</span>
<a id="__codelineno-9-68" name="__codelineno-9-68" href="#__codelineno-9-68"></a><span class="w"> </span><span class="nt">"module-name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"ietf-keystore"</span><span class="p">,</span>
<a id="__codelineno-9-69" name="__codelineno-9-69" href="#__codelineno-9-69"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-9-70" name="__codelineno-9-70" href="#__codelineno-9-70"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny"</span><span class="p">,</span>
<a id="__codelineno-9-71" name="__codelineno-9-71" href="#__codelineno-9-71"></a><span class="w"> </span><span class="nt">"comment"</span><span class="p">:</span><span class="w"> </span><span class="s2">"No user except admins can access cryptographic keys"</span>
<a id="__codelineno-9-72" name="__codelineno-9-72" href="#__codelineno-9-72"></a><span class="w"> </span><span class="p">},</span>
<a id="__codelineno-9-73" name="__codelineno-9-73" href="#__codelineno-9-73"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-9-74" name="__codelineno-9-74" href="#__codelineno-9-74"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny-truststore-access"</span><span class="p">,</span>
<a id="__codelineno-9-75" name="__codelineno-9-75" href="#__codelineno-9-75"></a><span class="w"> </span><span class="nt">"module-name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"ietf-truststore"</span><span class="p">,</span>
<a id="__codelineno-9-76" name="__codelineno-9-76" href="#__codelineno-9-76"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-9-77" name="__codelineno-9-77" href="#__codelineno-9-77"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny"</span><span class="p">,</span>
<a id="__codelineno-9-78" name="__codelineno-9-78" href="#__codelineno-9-78"></a><span class="w"> </span><span class="nt">"comment"</span><span class="p">:</span><span class="w"> </span><span class="s2">"No user except admins can access trust store"</span>
<a id="__codelineno-9-79" name="__codelineno-9-79" href="#__codelineno-9-79"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-9-80" name="__codelineno-9-80" href="#__codelineno-9-80"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-9-81" name="__codelineno-9-81" href="#__codelineno-9-81"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-9-82" name="__codelineno-9-82" href="#__codelineno-9-82"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-9-83" name="__codelineno-9-83" href="#__codelineno-9-83"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-9-84" name="__codelineno-9-84" href="#__codelineno-9-84"></a><span class="p">}</span>
</code></pre></div>
<p><strong>Key design decisions:</strong></p>
<ol>
<li><strong>Permit by default</strong> - <code>write-default: permit</code> allows operators to configure any module</li>
<li><strong>Minimal operator rules</strong> - Only one rule to permit system RPCs (reboot, set time)</li>
<li><strong>Future proof</strong> - New YANG modules automatically configurable by operators</li>
<li><strong>Targeted denials</strong> - Only sensitive items (passwords, keys) are explicitly denied</li>
<li><strong>Global denials</strong> - Password/keystore/truststore denied for everyone via group "*"</li>
<li><strong>YANG annotations</strong> - Sensitive operations (factory-reset, software upgrades) still protected by <code>nacm:default-deny-all</code> in YANG modules</li>
</ol>
<p><strong>Effective permissions by group:</strong></p>
<table>
<thead>
<tr>
<th>Group</th>
<th>Read</th>
<th>Write</th>
<th>Exec</th>
<th>Exceptions</th>
</tr>
</thead>
<tbody>
<tr>
<td>admin</td>
<td>All</td>
<td>All</td>
<td>All</td>
<td>None</td>
</tr>
<tr>
<td>operator</td>
<td>All</td>
<td>All</td>
<td>All</td>
<td>Cannot access passwords, keystore, truststore</td>
</tr>
<tr>
<td>guest</td>
<td>All</td>
<td>None</td>
<td>None</td>
<td>Read-only access</td>
</tr>
</tbody>
</table>
<h2 id="common-patterns">Common Patterns<a class="headerlink" href="#common-patterns" title="Permanent link"></a></h2>
<h3 id="permit-by-default">Permit-by-Default<a class="headerlink" href="#permit-by-default" title="Permanent link"></a></h3>
<p>The factory default approach - allow everything except sensitive items:</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-10-1" name="__codelineno-10-1" href="#__codelineno-10-1"></a><span class="p">{</span>
<a id="__codelineno-10-2" name="__codelineno-10-2" href="#__codelineno-10-2"></a><span class="w"> </span><span class="nt">"write-default"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span><span class="p">,</span>
<a id="__codelineno-10-3" name="__codelineno-10-3" href="#__codelineno-10-3"></a><span class="w"> </span><span class="nt">"exec-default"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span><span class="p">,</span>
<a id="__codelineno-10-4" name="__codelineno-10-4" href="#__codelineno-10-4"></a><span class="w"> </span><span class="nt">"rule-list"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-10-5" name="__codelineno-10-5" href="#__codelineno-10-5"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-10-6" name="__codelineno-10-6" href="#__codelineno-10-6"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"admin-acl"</span><span class="p">,</span>
<a id="__codelineno-10-7" name="__codelineno-10-7" href="#__codelineno-10-7"></a><span class="w"> </span><span class="nt">"group"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">"admin"</span><span class="p">],</span>
<a id="__codelineno-10-8" name="__codelineno-10-8" href="#__codelineno-10-8"></a><span class="w"> </span><span class="nt">"rule"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-10-9" name="__codelineno-10-9" href="#__codelineno-10-9"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-10-10" name="__codelineno-10-10" href="#__codelineno-10-10"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit-all"</span><span class="p">,</span>
<a id="__codelineno-10-11" name="__codelineno-10-11" href="#__codelineno-10-11"></a><span class="w"> </span><span class="nt">"module-name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-10-12" name="__codelineno-10-12" href="#__codelineno-10-12"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-10-13" name="__codelineno-10-13" href="#__codelineno-10-13"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span>
<a id="__codelineno-10-14" name="__codelineno-10-14" href="#__codelineno-10-14"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-10-15" name="__codelineno-10-15" href="#__codelineno-10-15"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-10-16" name="__codelineno-10-16" href="#__codelineno-10-16"></a><span class="w"> </span><span class="p">},</span>
<a id="__codelineno-10-17" name="__codelineno-10-17" href="#__codelineno-10-17"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-10-18" name="__codelineno-10-18" href="#__codelineno-10-18"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"global-denials"</span><span class="p">,</span>
<a id="__codelineno-10-19" name="__codelineno-10-19" href="#__codelineno-10-19"></a><span class="w"> </span><span class="nt">"group"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">"*"</span><span class="p">],</span>
<a id="__codelineno-10-20" name="__codelineno-10-20" href="#__codelineno-10-20"></a><span class="w"> </span><span class="nt">"rule"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-10-21" name="__codelineno-10-21" href="#__codelineno-10-21"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-10-22" name="__codelineno-10-22" href="#__codelineno-10-22"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny-passwords"</span><span class="p">,</span>
<a id="__codelineno-10-23" name="__codelineno-10-23" href="#__codelineno-10-23"></a><span class="w"> </span><span class="nt">"path"</span><span class="p">:</span><span class="w"> </span><span class="s2">"/ietf-system:system/authentication/user/password"</span><span class="p">,</span>
<a id="__codelineno-10-24" name="__codelineno-10-24" href="#__codelineno-10-24"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-10-25" name="__codelineno-10-25" href="#__codelineno-10-25"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny"</span>
<a id="__codelineno-10-26" name="__codelineno-10-26" href="#__codelineno-10-26"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-10-27" name="__codelineno-10-27" href="#__codelineno-10-27"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-10-28" name="__codelineno-10-28" href="#__codelineno-10-28"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-10-29" name="__codelineno-10-29" href="#__codelineno-10-29"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-10-30" name="__codelineno-10-30" href="#__codelineno-10-30"></a><span class="p">}</span>
</code></pre></div>
<p>This approach is "future proof" - new YANG modules are automatically
accessible without rule updates. Admins bypass the global denials
because their <code>permit-all</code> rule is evaluated first.</p>
<h3 id="deny-by-default">Deny-by-Default<a class="headerlink" href="#deny-by-default" title="Permanent link"></a></h3>
<p>More restrictive approach - deny everything except what is explicitly
allowed:</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-11-1" name="__codelineno-11-1" href="#__codelineno-11-1"></a><span class="p">{</span>
<a id="__codelineno-11-2" name="__codelineno-11-2" href="#__codelineno-11-2"></a><span class="w"> </span><span class="nt">"write-default"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny"</span><span class="p">,</span>
<a id="__codelineno-11-3" name="__codelineno-11-3" href="#__codelineno-11-3"></a><span class="w"> </span><span class="nt">"exec-default"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny"</span><span class="p">,</span>
<a id="__codelineno-11-4" name="__codelineno-11-4" href="#__codelineno-11-4"></a><span class="w"> </span><span class="nt">"rule-list"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-11-5" name="__codelineno-11-5" href="#__codelineno-11-5"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-11-6" name="__codelineno-11-6" href="#__codelineno-11-6"></a><span class="w"> </span><span class="nt">"group"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">"limited-user"</span><span class="p">],</span>
<a id="__codelineno-11-7" name="__codelineno-11-7" href="#__codelineno-11-7"></a><span class="w"> </span><span class="nt">"rule"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-11-8" name="__codelineno-11-8" href="#__codelineno-11-8"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-11-9" name="__codelineno-11-9" href="#__codelineno-11-9"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit-interface-config"</span><span class="p">,</span>
<a id="__codelineno-11-10" name="__codelineno-11-10" href="#__codelineno-11-10"></a><span class="w"> </span><span class="nt">"path"</span><span class="p">:</span><span class="w"> </span><span class="s2">"/ietf-interfaces:interfaces/interface"</span><span class="p">,</span>
<a id="__codelineno-11-11" name="__codelineno-11-11" href="#__codelineno-11-11"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"create update delete"</span><span class="p">,</span>
<a id="__codelineno-11-12" name="__codelineno-11-12" href="#__codelineno-11-12"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"permit"</span>
<a id="__codelineno-11-13" name="__codelineno-11-13" href="#__codelineno-11-13"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-11-14" name="__codelineno-11-14" href="#__codelineno-11-14"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-11-15" name="__codelineno-11-15" href="#__codelineno-11-15"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-11-16" name="__codelineno-11-16" href="#__codelineno-11-16"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-11-17" name="__codelineno-11-17" href="#__codelineno-11-17"></a><span class="p">}</span>
</code></pre></div>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>This requires updating NACM rules whenever new features are added.</p>
</div>
<h3 id="global-restrictions">Global Restrictions<a class="headerlink" href="#global-restrictions" title="Permanent link"></a></h3>
<p>Deny access to sensitive data for all users (except admins with permit-all):</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-12-1" name="__codelineno-12-1" href="#__codelineno-12-1"></a><span class="p">{</span>
<a id="__codelineno-12-2" name="__codelineno-12-2" href="#__codelineno-12-2"></a><span class="w"> </span><span class="nt">"rule-list"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-12-3" name="__codelineno-12-3" href="#__codelineno-12-3"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-12-4" name="__codelineno-12-4" href="#__codelineno-12-4"></a><span class="w"> </span><span class="nt">"group"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">"*"</span><span class="p">],</span>
<a id="__codelineno-12-5" name="__codelineno-12-5" href="#__codelineno-12-5"></a><span class="w"> </span><span class="nt">"rule"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
<a id="__codelineno-12-6" name="__codelineno-12-6" href="#__codelineno-12-6"></a><span class="w"> </span><span class="p">{</span>
<a id="__codelineno-12-7" name="__codelineno-12-7" href="#__codelineno-12-7"></a><span class="w"> </span><span class="nt">"name"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny-passwords"</span><span class="p">,</span>
<a id="__codelineno-12-8" name="__codelineno-12-8" href="#__codelineno-12-8"></a><span class="w"> </span><span class="nt">"path"</span><span class="p">:</span><span class="w"> </span><span class="s2">"/ietf-system:system/authentication/user/password"</span><span class="p">,</span>
<a id="__codelineno-12-9" name="__codelineno-12-9" href="#__codelineno-12-9"></a><span class="w"> </span><span class="nt">"access-operations"</span><span class="p">:</span><span class="w"> </span><span class="s2">"*"</span><span class="p">,</span>
<a id="__codelineno-12-10" name="__codelineno-12-10" href="#__codelineno-12-10"></a><span class="w"> </span><span class="nt">"action"</span><span class="p">:</span><span class="w"> </span><span class="s2">"deny"</span>
<a id="__codelineno-12-11" name="__codelineno-12-11" href="#__codelineno-12-11"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-12-12" name="__codelineno-12-12" href="#__codelineno-12-12"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-12-13" name="__codelineno-12-13" href="#__codelineno-12-13"></a><span class="w"> </span><span class="p">}</span>
<a id="__codelineno-12-14" name="__codelineno-12-14" href="#__codelineno-12-14"></a><span class="w"> </span><span class="p">]</span>
<a id="__codelineno-12-15" name="__codelineno-12-15" href="#__codelineno-12-15"></a><span class="p">}</span>
</code></pre></div>
<h2 id="debugging-nacm">Debugging NACM<a class="headerlink" href="#debugging-nacm" title="Permanent link"></a></h2>
<h3 id="viewing-effective-permissions">Viewing Effective Permissions<a class="headerlink" href="#viewing-effective-permissions" title="Permanent link"></a></h3>
<p>Check what NACM groups a user belongs to:</p>
<pre class="cli"><code>admin@example:/&gt; <b>show nacm</b>
enabled : yes
default read access : permit
default write access : permit
default exec access : permit
denied operations : 0
denied data writes : 0
denied notifications : 0
┌──────────┬─────────┬─────────┬─────────┐
│ GROUP │ READ │ WRITE │ EXEC │
├──────────┼─────────┼─────────┼─────────┤
│ admin │ ✓ │ ✓ │ ✓ │
│ operator │ ⚠ │ ⚠ │ ⚠ │
│ guest │ ⚠ │ ✗ │ ✗ │
└──────────┴─────────┴─────────┴─────────┘
✓ Full ⚠ Restricted ✗ Denied
<span class="header">USER SHELL LOGIN </span>
admin bash password+key
jacky bash password
monitor false key
<span class="header">GROUP USERS </span>
admin admin
operator jacky
guest monitor
</code></pre>
<p>For details about a group's restrictions, use <code>show nacm group &lt;name&gt;</code>:</p>
<pre class="cli"><code>admin@example:/&gt; <b>show nacm group operator</b>
members : jacky
read permission : restricted
write permission : restricted
exec permission : restricted
applicable rules : 4
──────────────────────────────────────────────────────────────────────
<span class="title">permit-system-rpcs</span>
action : permit
operations : exec
target : ietf-system (rpc: *)
──────────────────────────────────────────────────────────────────────
<span class="title">deny-password-access (via '*')</span>
action : deny
operations : *
target : /ietf-system:system/authentication/user/password
──────────────────────────────────────────────────────────────────────
<span class="title">deny-keystore-access (via '*')</span>
action : deny
operations : *
target : ietf-keystore
──────────────────────────────────────────────────────────────────────
<span class="title">deny-truststore-access (via '*')</span>
action : deny
operations : *
target : ietf-truststore
</code></pre>
<h3 id="testing-access">Testing Access<a class="headerlink" href="#testing-access" title="Permanent link"></a></h3>
<p>The easiest way to test NACM permissions is to log in as the user and try
the operation:</p>
<pre class="cli"><code>$ ssh jacky@host
jacky@example:/&gt; <b>configure</b>
jacky@example:/config/&gt; <b>edit system authentication user admin</b>
jacky@example:/config/system/authentication/user/admin/&gt; <b>set authorized-key foo</b>
Error: Access to the data model "ietf-system" is denied because "jacky" NACM authorization failed.
Error: Failed applying changes (2).
</code></pre>
<h3 id="nacm-statistics">NACM Statistics<a class="headerlink" href="#nacm-statistics" title="Permanent link"></a></h3>
<p>NACM tracks denied operations. If you suspect permission issues, check
the statistics:</p>
<pre class="cli"><code>admin@example:/&gt; <b>show nacm</b>
...
denied operations : 5
denied data writes : 12
...
</code></pre>
<p>Increasing counters indicate permission denials are occurring.</p>
<h2 id="best-practices">Best Practices<a class="headerlink" href="#best-practices" title="Permanent link"></a></h2>
<ol>
<li>
<p><strong>Leverage permit-by-default</strong> - The factory configuration uses
<code>write-default: "permit"</code> with targeted denials. This is "future proof" -
new features work immediately without NACM updates.</p>
</li>
<li>
<p><strong>Protect sensitive items globally</strong> - Use <code>group: ["*"]</code> rule-list to
deny access to passwords, cryptographic keys, and similar sensitive data.
Admin's permit-all rule (evaluated first) bypasses these denials.</p>
</li>
<li>
<p><strong>Leverage YANG annotations</strong> - Many sensitive operations are already
protected by <code>nacm:default-deny-all</code> in YANG modules (factory-reset,
software upgrades, etc.). Only add explicit permit rules when needed.</p>
</li>
<li>
<p><strong>Order matters</strong> - Rule-lists are evaluated in order. Place admin's
permit-all rule first so it bypasses global denials.</p>
</li>
<li>
<p><strong>Use path-based denials</strong> - For protecting specific data (like password
hashes), use path rules. For protecting entire modules (like keystore),
use module-name rules.</p>
</li>
<li>
<p><strong>Test thoroughly</strong> - Always test user permissions after changes. NACM
errors can be subtle (nodes may be silently omitted from read operations).</p>
</li>
<li>
<p><strong>Keep it simple</strong> - The factory configuration uses only 6 rules for
three user levels. Fewer rules are easier to understand and maintain.</p>
</li>
<li>
<p><strong>Document rules</strong> - Use the "comment" field to explain why specific
permissions are granted or denied.</p>
</li>
</ol>
<h2 id="references">References<a class="headerlink" href="#references" title="Permanent link"></a></h2>
<ul>
<li><a href="https://www.rfc-editor.org/rfc/rfc8341">RFC 8341: Network Configuration Access Control Model (NACM)</a></li>
<li><a href="https://www.rfc-editor.org/rfc/rfc7317">RFC 7317: A YANG Data Model for System Management (ietf-system)</a></li>
<li><a href="https://www.rfc-editor.org/rfc/rfc8808">RFC 8808: A YANG Data Model for Factory Default Settings (ietf-factory-default)</a></li>
<li><a href="https://www.rfc-editor.org/rfc/rfc8177">RFC 8177: YANG Key Chain (ietf-key-chain)</a></li>
<li><a href="../system/#multiple-users">System Configuration - Multiple Users</a></li>
</ul>
</article>
</div>
<script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script>
</div>
</main>
<footer class="md-footer">
<div class="md-footer-meta md-typeset">
<div class="md-footer-meta__inner md-grid">
<div class="md-copyright">
<div class="md-copyright__highlight">
Copyright © 2022-2025 The KernelKit Team
</div>
</div>
</div>
</div>
</footer>
</div>
<div class="md-dialog" data-md-component="dialog">
<div class="md-dialog__inner md-typeset"></div>
</div>
<div class="md-progress" data-md-component="progress" role="progressbar"></div>
<script id="__config" type="application/json">{"annotate": null, "base": "..", "features": ["toc.follow", "navigation.path", "navigation.instant", "navigation.instant.progress", "navigation.tracking", "navigation.indexes", "search.highlight", "search.share", "content.code.copy", "content.code.annotate", "content.footnote.tooltips"], "search": "../assets/javascripts/workers/search.2c215733.min.js", "tags": null, "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}, "version": {"provider": "mike"}}</script>
<script src="../assets/javascripts/bundle.79ae519e.min.js"></script>
<script id="init-glightbox">const lightbox = GLightbox({"touchNavigation": true, "loop": false, "zoomable": true, "draggable": true, "openEffect": "zoom", "closeEffect": "zoom", "slideEffect": "slide"});
document$.subscribe(()=>{ lightbox.reload(); });
</script></body></html>
Reference in New Issue View Git Blame Copy Permalink