What you are trying to do is possible with AAA authorization. For that on the router these are the AAA commands required:
aaa new-model
aaa authentication login default [group] local
aaa authorization exec default [group] local
Before you enter these, plese make sure to create the local user database as follows:
username level_zero privilege 0 password zero
username basic_user privilege 1 password one
username admin privilege 15 password admin
With the above setup, user level_zero can execute only disable, enable, exit, help, and logout commands.
User basic_user can execute all the level 0 and level 1 commands.
User admin can execute all the commands on the router.
On the router these are the 3 level of default commands:
-privilege level 0 — includes the disable, enable, exit, help, and logout commands
- privilege level 1 — normal level on Telnet; includes all user-level commands at the router> prompt
- privilege level 15 — includes all enable-level commands at the router#
prompt
Now based on your requirement, you can create a priv level bewteen 2-14 and assign any priv level 15 commands (level 0 and 1 would be inherited by default). Here is an example:
username six privilege 6 password 0 six
With this, user six is only able to execute all the level 0 & 1 commands. If the user need to execute "config t" on the router, he has to add the following line to add this level 15 commans to level 6.
privilege exec level 6 configure terminal
I hope this helps ! Please be aware of the "show running-config" though. For a better understanding of this special behavior of this command please refer to the following link:
http://www.cisco.com/warp/public/63/showrun.shtml
Mynul
