Custom privilege level for Show Run command does not give full output

[iguidroz]

I need to create a read only custom privilege level for an automated service acct that can execute the show run and show tech commands. I used privilege level 2 for the radius authentication and have the below commands set on my test switch. I am able to execute the show run command, but only see a few lines of output.

IOS Privilege Levels Cannot See Complete Running Configuration - Cisco

After reading up on this, I see several people running into the same situation where it appears that the show run command will not give output on any parameter that the current account does not have access to configure. This would mean that there is not an option to create a read only account. I have re-read this document a few times and believe that I must certainly be missing something here. 

Priv-2 commands

• privilege exec level 2 show running-config
• privilege exec level 2 show tech

[MHM Cisco World]

Did you try 

Role-Based Access Control (RBAC)?

This can solve your issue.

MHM

[iguidroz]

I have not, I will give this a shot today. Thank you for the suggestion!

[liviu.gheorghe]

Hello @iguidroz ,

what you are describing is normal behaviour with privilege exec commands in IOS. Look at the additional details at the end of the linked document you provided.

One way of doing things is to move all commands the level2 user needs to see in show running output on privilege exec level 2.

Hope this helps.

[iguidroz]

Thanks for the response!

That is what I was afraid of. I do not want to allow write access for commands in order to do this. I am in a high security environment and the account is in use by an automated service that needs to view the entire running config. It is interesting to me that Cisco has this restricted view of the running config, due to "security reasons", but allows view of the entire startup config. Sounds like a bug rebranded as a feature to me.

[liviu.gheorghe]

I don't think it's a question of a bug. it's more a question of history. I know this feature has been around in this form for more than 20 years. Back then security wasn't as important as it is today, at least for a vast majority of customers.

In this case, what @MHM Cisco World suggested could be a better solution. I haven't used it in any implementation, so I cannot say for sure if it's a right fit for you, but it's worth a shot.

[iguidroz]

Ahh that makes more sense. I am looking into the RBAC solution now.