# How to disable Confd CLI access for all users and specific users
**URL:** https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662
**Category:** General
**Created:** [May 19, 2021, 5:55pm UTC](https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662 "2021-05-19T17:55:32Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@venkonan](https://dmap-community.ductus.global/u/venkonan)
#### Post date: [May 19, 2021, 5:55pm UTC](https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662/1 "2021-05-19T17:55:32Z")
Hi,
Can you please let me know how to disable access to confd CLI for all users and specific users.
Thanks,
-Venkat
---
### Author:  [@cohult](https://dmap-community.ductus.global/u/cohult)
#### Post date: [May 19, 2021, 6:32pm UTC](https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662/2 "2021-05-19T18:32:21Z")
Hi,
See ConfD UG Chapter “The AAA infrastructure”, subchapter “Group Membership” and “Authorization”.
In an nutshell you tie the users to a NACM group, then you associate NACM rules with the group. The NACM rules have a “context” setting that you set to for example “cli” for your deny/premitt rules.
Regards
---
### Author:  [@venkonan](https://dmap-community.ductus.global/u/venkonan)
#### Post date: [May 20, 2021, 6:58pm UTC](https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662/3 "2021-05-20T18:58:09Z")
Thank you.
Other than NACM rules, do we have other way to disable confd cli access in a product? Customers will use netconf and within product, we use MAAPI API. So we are planning to disable confd cli access.
---
### Author:  [@cohult](https://dmap-community.ductus.global/u/cohult)
#### Post date: [May 20, 2021, 9:01pm UTC](https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662/4 "2021-05-20T21:01:06Z")
To disable the CLI for all users in your confd.conf file:
```xml
false
```
---
### Author:  [@venkonan](https://dmap-community.ductus.global/u/venkonan)
#### Post date: [May 21, 2021, 6:35pm UTC](https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662/5 "2021-05-21T18:35:17Z")
I tried this already, but still I’m able to login. Here are my configs.
```auto
true
false
0.0.0.0
2024
denied
```
---
### Author:  [@cohult](https://dmap-community.ductus.global/u/cohult)
#### Post date: [May 21, 2021, 7:48pm UTC](https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662/6 "2021-05-21T19:48:42Z")
Try adding an enabled false tag value as I described. E.g.:
```auto
false
true
false
0.0.0.0
2024
denied
```
---
### Author:  [@venkonan](https://dmap-community.ductus.global/u/venkonan)
#### Post date: [May 21, 2021, 9:05pm UTC](https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662/7 "2021-05-21T21:05:21Z")
This also doesn’t help. ssh admin@localhost -p 2024 login works.
am I missing anything here?
---
### Author:  [@cohult](https://dmap-community.ductus.global/u/cohult)
#### Post date: [May 21, 2021, 10:08pm UTC](https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662/8 "2021-05-21T22:08:28Z")
If yiou have enabled dynamic configuration, i.e. your confd.conf has this tag value set: `namespace`
,Then you need to have the same config to disable the CLI in your “confd\_dyncfg\_init.xml” file.
---
### Author:  [@venkonan](https://dmap-community.ductus.global/u/venkonan)
#### Post date: [June 1, 2021, 8:19pm UTC](https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662/9 "2021-06-01T20:19:46Z")
> [@cohult](#):
>
> confd\_dyncfg\_init.xml
We don’t have this config in our confd.conf file.
---
### Author:  [@cohult](https://dmap-community.ductus.global/u/cohult)
#### Post date: [June 1, 2021, 9:17pm UTC](https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662/10 "2021-06-01T21:17:53Z")
> [@venkonan](#):
>
> We don’t have this config in our confd.conf file.
Then it is magic or you missed something in my suggestions above
---
### Author:  [@ltrinh](https://dmap-community.ductus.global/u/ltrinh)
#### Post date: [June 1, 2021, 9:48pm UTC](https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662/11 "2021-06-01T21:48:00Z")
I think you can also control this by sessionLimit in the confd.conf:
```
cli
0
```
---
### Author:  [@greg](https://dmap-community.ductus.global/u/greg)
#### Post date: [June 2, 2021, 4:51pm UTC](https://dmap-community.ductus.global/t/how-to-disable-confd-cli-access-for-all-users-and-specific-users/3662/12 "2021-06-02T16:51:55Z")
Venkat,
I tried Conny’s suggestion to disable the CLI in confd.conf and it works for me. I used intro/1-2-3-start-query-model and did the following:
Step 1: disable the CLI (not by default it is enabled and so this needs to be added to confd.conf)
```auto
false
```
Step 2: try connecting via SSH, with the error being returned:
```auto
$ ssh admin@localhost -p 2024
ssh: connect to host localhost port 2024: Connection refused
```
Step 3: try connecting using confd\_cli, and even that will fail:
```auto
confd_cli --user=admin --groups=admin \
--interactive || echo Exit
Failed to connect to server
Exit
```
So in this simple case, it works as you would expect. Check to make sure you are editing the right confd.conf file, that you aren’t using dynamic configuration, and that you have stopped and restarted ConfD after changing the configuration. You might also want to try this simple example just to verify to yourself that this disables the CLI.