The following table provides the default mapping between NSP components, sudoers files, and users.

If you employ a special sudoers configuration, privileged users that you create can execute only specific NSP management and deployment commands. If a user other than the privileged non-root user attempts to execute a restricted command, the command fails.

You can also prevent remote root-user access to the stations in an NSP deployment by designating a specific privileged user for remote access.

You can restrict root-user access on the NSP deployer host and cluster VMs; NSP auxiliary database; and on NFM-P main server, auxiliary server, and main database stations.

Note: Client delegate servers do not support restricted root access.

The root user performs the initial OS and VM setup for an NSP deployment and creates the alternative users with restricted access. The root user is not required for NSP deployment operations afterward.

Restricted root-user access:

• assigns sudo privileges for only the required commands per user

• ensures that any configuration or control actions are traceable to a specific user

See “Restricting root-user system access” in the NSP Installation and Upgrade Guide for more information.

NSP users can enable AIDE (Advanced Intrusion Detection Environment) —; a file integrity monitoring tool —; to create a database of file attributes (hashes, permissions, timestamps, ownership) This is compared against the current filesystem state. NSP uses this database to ensure file integrity and detect system intrusions. Users interested in enabling AIDE must contact Nokia support.

Note: AIDE can only be enabled after NSP installation has been completed.

Note: AIDE must be disabled before performing any NSP-related reconfigurations, uninstallations, or reinstallations. Once these activities have been completed, the AIDE database must be reinitialized to create a new baseline for AIDE verification.