topic Re: Can I disable some commands to privilege level 2 users? in Network Access Control

Can I disable some commands to privilege level 2 users?

s.souroutis — Sun, 10 Mar 2019 14:52:04 GMT

Hello,

I am trying to configure some users with different privileges on a 7505 router.

I'm using the aaa method local on the 7505.

I'm not using a RADIUS or TACACS server.

I did create some users with privilege level 15 and some with privilege level 2 but I want some users to have access only on the show command.

The problem is that if a level 2 user has the level 15 enable password he can have full access. I want to disable the command enable 15 for all privilege level 2 users.

Can I do that?

Thank you

Re: Can I disable some commands to privilege level 2 users?

didyap — Wed, 16 Jun 2004 19:09:39 GMT

Guess this can be done. Use the privilege exec command.

Re: Can I disable some commands to privilege level 2 users?

didier.wiroth — Thu, 17 Jun 2004 06:02:55 GMT

Hi,

This works for other commands (I don't have cli to test right now), so this should work:

Move hte enable command to level 3 or any other upper level you want:

privilege exec level 3 enable

Re: Can I disable some commands to privilege level 2 users?

jodilovell — Thu, 17 Jun 2004 08:28:08 GMT

Hi,

Moving the enable command to a different level should work but what you can also do is configure separate enable passwords for the various levels if the users at level 2 require some enable level commands.

enable secret level {0 |5} password-string

Re: Can I disable some commands to privilege level 2 users?

s.souroutis — Fri, 18 Jun 2004 06:35:25 GMT

Thank you all. I used the privilege exec level 3 enable command to move the enable command to level 3. This works fine.

Re: Can I disable some commands to privilege level 2 users?

jeff — Wed, 25 Aug 2004 00:12:13 GMT

I have a Cisco router running aaa new-model authentication with local usernames. I have a username that I would like to have only access to the exec prompt only with the ability to execute the show run command. I've tried the suggestions in this thread but I seem to be missing something, because when I sign in with the username with privilege level 2 and with a enable secret level 2, I still have to use the default enable secret password eventually giving the username level 15 access.

Can someone suggest the commands I need to restrict a username to only the "show running-configuration" command?

Thanks for any help

Jeff