Prevent a user from creating a new user with high privileges

[mralshabib]

Hi

I'm working on modifying privileges (using privilege exec level commands), my target is to customize privileges so that user with 5 privileges can create usernames ONLY with the same privileges or less, as I see that the user can create another username with higher privileges above 5 (vulnerability).

It seems that it's impossible. I can only allow or disallow user creation.

[antisocial11224 · Accepted solution]

---

@mralshabib wrote:

Hi

I'm working on modifying privileges (using privilege exec level commands), my target is to customize privileges so that user with 5 privileges can create usernames ONLY with the same privileges or less, as I see that the user can create another username with higher privileges above 5 (vulnerability).

It seems that it's impossible. I can only allow or disallow user creation.

---

To address the issue of preventing a user with privilege level 5 from creating new users with higher privileges, it is crucial to modify the privilege levels effectively. As you mentioned, using privilege exec level commands only allows or disallows user creation without restricting the level of privileges assigned to new users. Unfortunately, within the standard privilege configuration commands, there is no built-in mechanism to enforce that a user can only create other users with the same or lower privileges. This creates a potential vulnerability where users can elevate privileges beyond their assigned level. To mitigate this, you can implement additional administrative controls or scripts that monitor and enforce privilege assignments, ensuring compliance with the intended security policy. Additionally, consider using role-based access control (RBAC) systems or other advanced access management tools that offer more granular control over user permissions and can enforce such restrictions directly.

[MHM Cisco World]

the priv 5 dont have the command to add username and priv 15 ?
are you sure you config user with priv 5 in such away can not enter other priv 
the key here is make user priv 5 can not go to priv 15 
I will check in lab how we can do this and update you 

MHM

[mohamedlamine · Accepted solution]

If you are looking to restrict users from creating other usernames with privileges higher than their own level using privilege exec level commands, it is important to note that this capability may not be directly achievable through standard privilege level configurations alone. The privilege level commands typically control access to specific commands or functions within the network device, rather than setting restrictions on the creation of user accounts with specific privileges.

To address the specific scenario you mentioned, you may need to consider additional security measures or configurations outside of the privilege level commands. Here are a few suggestions that you could explore:

1. Role-Based Access Control (RBAC): Implement RBAC mechanisms to control user access and permissions based on predefined roles. By assigning users to specific roles with corresponding permissions, you can restrict their ability to create user accounts with privileges higher than their own role.

2. Custom Scripts or Automation: Develop custom scripts or automation tools that validate the privileges of the user creating a new account and enforce restrictions based on predefined rules. These scripts can help ensure that users can only create accounts with equal or lower privileges.

3. Regular Auditing and Monitoring: Implement regular auditing and monitoring processes to detect any unauthorized changes in user privileges or account creations. By monitoring user activities and access, you can proactively identify and address any potential security vulnerabilities.

While standard privilege exec level commands may not provide a direct solution to restrict user account creations based on privileges, combining different security mechanisms and practices can help enhance access control and mitigate the risk of unauthorized privilege escalation.