---
title: "About CLI Credentials"
canonical: "https://docs.infoblox.com/space/NetMRIAdminG752/42107628/About%20CLI%20Credentials"
format: markdown
---
The **CLI** tab (**Settings** icon > **Setup** > **Credentials** –> **CLI** tab) lists site-specific username and password combinations that NetMRI uses when attempting to access a device using telnet or SSH. After a device is discovered, NetMRI uses these for configuration collection, CCS scripts, and other purposes.

> ⚠️ **Note**
> ⚠️ 
> ⚠️ For CLI access to managed devices, NetMRI needs the ENABLE password to access configuration files on some devices but does not need it for any other reason. Therefore, Infoblox recommends you create a username and password specifically for NetMRI, and restrict the commands that can be executed by that account to those required to display the configuration information.

The **CLI** **Vendor** **Defaults** tab (**Settings** icon > **Setup** > **Credentials** > **CLI** **Vendor** **Defaults** tab) lists well-known (and therefore weak) username and password combinations. These credentials are a subset of the published vendor default usernames/passwords used when the device is shipped by the manufacturer.

Add other vendor default passwords listed in the Default Credentials Report. If the **Vendor** **Default** **Credential** **Collector** option (**Settings** icon >** Setup** >** Collection** **and** **Groups **> **Global** tab > **Config** **Management** panel) is enabled and a vendor default username/password combination successfully logs into a device, an issue is generated.

NetMRI will try site-specific usernames/passwords, in priority order, when first logging in to a device via a CLI connection (SSH or telnet). Once NetMRI determines a password, it will save it as information specific to the device. The system will try the vendor default credentials in priority order if there is no site-specific password. NetMRI will always use site-specific username/password combinations when trying to determine the new login credentials for a device, and they will not be used for vendor default credential checks.