---
title: "About CLI Credentials"
canonical: "https://docs.infoblox.com/space/NetMRI753/42010490/About%20CLI%20Credentials"
format: markdown
---
The **CLI** tab (**Settings** icon > **Setup** > **Credentials** > **CLI** tab) lists site-specific username and password combinations that NetMRI uses when attempting to access a device using telnet or SSH. After a device is discovered, NetMRI uses these for configuration collection, CCS scripts, and other purposes.

> ⚠️ **Note**
> ⚠️ 
> ⚠️ For CLI access to managed devices, NetMRI needs the ENABLE password to access configuration files on some devices but does not need it for any other reason. Therefore, Infoblox recommends you create a username and password specifically for NetMRI, and restrict the commands that can be executed by that account to those required to display the configuration information.

The **CLI** **Vendor** **Defaults** tab (**Settings** icon > **Setup** > **Credentials** > **CLI** **Vendor** **Defaults** tab) lists well-known (and therefore weak) username and password combinations. These credentials are a subset of the published vendor default username/passwords used when the device is shipped by the manufacturer.

Add other vendor default passwords listed in the Default Credentials Report. If the **Vendor** **Default** **Credential** **Collector** option (**Settings** icon >** Setup** >** Collection** **and** **Groups **> **Global** tab > **Config** **Management** panel) is enabled and a vendor default username/password combination successfully logs into a device, an issue is generated.

NetMRI will try site-specific username/passwords, in priority order, when first logging in to a device via a CLI connection (SSH or telnet). Once NetMRI determines a password, it will save it as information specific to the device. If there is no site-specific password, the system will try the vendor default credentials in priority order. NetMRI will always use site-specific username/password combinations when trying to determine the new login credentials for a device, and they will not be used for vendor default credential checks.