Hello @zietgiestt,
what you’re seeing is actually expected Cisco IOS behavior.
The “show running‑config” command only displays commands that the user has permission to modify at their current privilege level.
So if the privilege level does not include any configuration‑mode permissions, the command succeeds but returns almost no output.
This is a hard-coded security feature to prevent non‑admin users from reading sensitive configuration such as AAA, keys, passwords, or SNMP communities and implemented by configuration‑view filtering based on privilege level.
However, you can bypass this security restriction by using the file system and the 'more system:running‑config' command.
This allows the user to read the system: virtual file (which contains the entire running config):
! Authorize file access at privilege level 5
!
file privilege 5
!
! Allow the 'more' command at privilege level 5
!
privilege exec level 5 more
privilege exec level 5 show startup-config
privilege exec level 5 show logging
!
username contractor privilege 5 secret Cisco123
As a result the “contractor” user can log in and use the 'more system:running-config' as well as accessing the startup-config and the log files.
Needless to say that you need to be very careful when bypassing security features as they are implemented on purpose!
HTH!
