allowed-user

This command specifies the users allowed to use the channel.

Syntax

Allows a user
allowed-user ID [privilege] [SOL] [sessions]
Disallows a user
no allowed-user ID

Parameters

ID
Specifies the name of an existing Intelligent Platform Management Interface (IPMI) user to enable on this LAN channel. To create an IPMI user, use the Global ipmi-user command.
privilege
Optional: Sets the maximum privilege level to allow the user on this LAN channel.
callback
Allows IPMI commands that establish a callback connection.
user
Allows IPMI commands that read operational status. This setting is the default value.
operator
Allows IPMI commands that change operational status.

If this value is greater than the value set with the maximum-channel-privilege-level command, the value set with the maximum-channel-privilege-level command is the effective level.

SOL
Optional: Indicates whether to allow the user to use the serial over LAN protocol (payload) over Remote Control and Management Protocol Plus (RCMP+) on this LAN channel.
on
The user can use serial over LAN provided that the user has a privilege level equivalent to or greater than the minimum required privilege level set with the sol-required-user-privilege-level command. This setting is the default value.
off
The user cannot use serial over LAN.
sessions
Optional: Sets the maximum number of simultaneous sessions to allow the user on this LAN channel. The minimum value is 0, and the maximum value is 7. If set to 0, there is no limit. The default value is 0.

Guidelines

The allowed-user command specifies a user allowed to use this LAN channel. For each user, include the maximum privilege level, whether to allow serial over LAN, and the maximum number of simultaneous sessions. Use this command for each user to allow.

CAUTION:
If you enable serial over LAN support for the IPMI LAN channel, an IPMI user who connects through an IPMI 2.0 client has access to the serial console port.
  • An IPMI user can connect through an IPMI 2.0 client independent of the state of the appliance. The only time that an IPMI user cannot connect to the appliance is when the appliance is disconnected from AC power.
  • An IPMI user has higher priority than a user who is directly connected to the serial port.
  • If a user is directly connected to the serial port, the IPMI user usurps the current serial session and does not need to log in to the appliance. If no user is directly connected to the serial port, the IPMI user must log in to the appliance.
  • There can be only one serial user. The IPMI user suspends the serial session of the user who is directly connected to the serial port until the remote IPMI user closes (deactivates) the serial session. When the IPMI user closes the serial session, the session for the user who is directly connected to the serial port resumes.
  • If an IPMI user is connected to the appliance and you need to use the serial port, you must unplug the Ethernet cable from the MGT0 port. After you unplug the cable, wait for the serial port to become available, which can take up to 20 minutes.

Use the no allowed-user command to disallow a user on this LAN channel.