topic Re: access to enable mode via SSH without password ? in Network Access Control

access to enable mode via SSH without password ?

ocsic_user — Sun, 17 Mar 2024 21:01:57 GMT

Hello,

In our company we have two sites first we work on it and the second far from us 700 km usually I mange second site routers via SSH but recently we lost access so our engineer moved to the second site and remove all users & passwords from rom-mon and he create one user privilege 15.

when he returned we tried to access when we enter enable it showed this error " % error in authentication "

in summary I can access from console but not from SSH

please I want to ask if is there any possibility to access with SSH without moving to the second site

thank you.

Re: access to enable mode via SSH without password ?

MHM Cisco World — Sun, 17 Mar 2024 21:06:02 GMT

if you use AAA then this issue can solved but I need to see config first

MHM

Re: access to enable mode via SSH without password ?

ocsic_user — Sun, 17 Mar 2024 21:25:47 GMT

thank you @MHM Cisco World

i'm stucked in User exec mode mode tomorrow i will give you feedback

Re: access to enable mode via SSH without password ?

ocsic_user — Mon, 18 Mar 2024 07:46:52 GMT

hello

yes we have aaa server local configured is the router

aaa new-model
aaa local authentication attempts max-fail 5
!
!
aaa authentication login default local
!

Re: access to enable mode via SSH without password ?

MHM Cisco World — Mon, 18 Mar 2024 07:54:46 GMT

the user have privilege set ? i.e. the local user it enter like below
username xxx privilege 15 password xxx <<-
if not add new user and set it privilege to 15 and check again

MHM

Re: access to enable mode via SSH without password ?

ocsic_user — Mon, 18 Mar 2024 08:28:36 GMT

hello

yes user privilege 15 already aded and the site is far from here so i can't access with the console

Re: access to enable mode via SSH without password ?

ocsic_user — Mon, 18 Mar 2024 11:05:13 GMT

hello

is there any solution to get in privileged exec mode ?

Re: access to enable mode via SSH without password ?

MHM Cisco World — Mon, 18 Mar 2024 11:19:18 GMT

There is

Aaa authorization exec defualt local

This command check the privilege for user in local dB to make user enter level 15 directly no need enable.

But you need to be careful

Dont wr the config until you sure that this command help you if it reject access to router via console then you can reboot and return to previous point before add the command.

If you wait me I need to do some lab and share result here.

MHM

Re: access to enable mode via SSH without password ?

ocsic_user — Mon, 18 Mar 2024 11:31:10 GMT

We are enable to execute any command because we are in user-exec mode. The command you just gave us doesn't work. Is there a workaround ?

Re: access to enable mode via SSH without password ?

MHM Cisco World — Mon, 18 Mar 2024 11:36:08 GMT

You need also additional to previous command

line vty 0 4

authorization exec defualt

Re: access to enable mode via SSH without password ?

Charlie Moreton — Mon, 18 Mar 2024 13:30:47 GMT

It's time to drive out there.

Re: access to enable mode via SSH without password ?

MHM Cisco World — Mon, 18 Mar 2024 21:56:26 GMT

any update ?

MHM

Re: access to enable mode via SSH without password ?

ocsic_user — Tue, 19 Mar 2024 08:45:08 GMT

hello

no update i can't execut that commande this mode "Router>"

Re: access to enable mode via SSH without password ?

MHM Cisco World — Tue, 19 Mar 2024 14:25:01 GMT