IOS-XE management access and AAA

Rules for who can log in to the device and how. This page has one rule so far. More will be added as the rConfig test suite covers them.

---

Only approved local accounts

What it checks and why

Local accounts are the fallback when AAA servers are unreachable, which makes them a favourite place for forgotten or shared logins. This rule requires a fixed set of local accounts and fails if any other username line exists. It is a single regular expression: three lookaheads require the approved names, and a negative lookahead rejects any other name. \b stops a near-miss such as netadmin1 from counting as netadmin.

Definition

// Only the approved local accounts exist: netadmin, netops and auditor
#[must_match_regex]
/^(?=.*^username netadmin\b)(?=.*^username netops\b)(?=.*^username auditor\b)(?!.*^username (?!netadmin\b|netops\b|auditor\b).+)/ms

Replace the three names with your own, in both places they appear: the positive lookaheads and the list inside the negative lookahead.

Passing config

username netadmin privilege 15 secret 9 $9$EXAMPLEONLYhash000000001
username netops secret 9 $9$EXAMPLEONLYhash000000002
username auditor secret 9 $9$EXAMPLEONLYhash000000003

Failing config

username netadmin privilege 15 secret 9 $9$EXAMPLEONLYhash000000001
username netops secret 9 $9$EXAMPLEONLYhash000000002
username auditor secret 9 $9$EXAMPLEONLYhash000000003
username netadmin1 secret 9 $9$EXAMPLEONLYhash000000004
username temp secret 9 $9$EXAMPLEONLYhash000000005

Expected result in rConfig

Config	Rule result	Overall result
Passing config	pass	PASS
Failing config	fail (netadmin1 and temp are not approved)	FAIL

Caution

This pattern has a blind spot. With the m flag, ^ can match at the start of any line, so the engine can begin its match at the first approved account and only looks for unapproved names after that point. An unapproved account that appears in the config before all of the approved ones is not caught. Treat a pass as “no unapproved accounts after the approved ones” until the rule is improved.

Framework mapping

Framework	Reference
Not yet mapped	See Frameworks

Tested with

Item	Detail
Tested OS version	None. The configs were written for the test in IOS-XE syntax, not captured from a device.
Minimum rConfig version	8.0.0 (must_match_regex)
Editions	Pro, Vector, Enterprise
Source	CustomerUseCases/UsernamePolicyMethodsTest::test_must_match_regex_usernames_passes_only_valid_users and test_must_match_regex_usernames_fails_with_extra_users