How to restrict normal users from viewing logging buffer

[dhanushkas]

Hi All,

I would like to give normal user with all the configuring and show commands except running show logging command. i.e I want to restrict normal users by viewing syslog buffer in the switch.

I would appreciate if anyone can help me on this.

Thank you and Regards,

Gayan Samarakoon. 

[dhanushkas]

Hi All,

I would like to give normal users all the configurations and show command privileges except show logging command. i.e. I want to restrict normal users from viewing logging buffer.

It would be really greatfull if some one can help me on this.

Thank you and Regards,

Dhanushka

[balaji.bandi]

how is your user AAA configured , Local or any ACS/ ISE/ or Radius ?

you need to restrict the user to only with permit commands, so rest will be not authorized: its easy (if you use any identity-based system, if this is local you need to enter manually for that user - manual task)

example :

For user 

permit running-config

permit cdp neigh

[dhanushkas]

Hi Balaji,

Thank you for your prompt reply.

These users are created locally, I only want to restrict "show logging" command, all other commands should be permitted. Can this be done.

Thank you,

Dhanushka.

[Kasun Bandara]

you can assign commands for privilege levels and assign relevant level to user.

https://study-ccna.com/cisco-privilege-levels/

Also you can use parser views to configure views and let relevant user to load permitted view at enable.

[dhanushkas]

Hi Kasun,

Thank you for your reply.

I only want to restrict "show logging" command only. All Other commands should be allowed. Can this be achieved without permitting all the commands explicitly which is bit cumbersome.

Thank you,

Dhanushka.

[MHM Cisco World]

https://www.omnisecu.com/ccna-security/parser-views-role-based-access-control-rbac.php

PARSER view can solve you issue.

[dhanushkas]

Hi MHM,

Thanks a lot for your reply.

I will run this configuration in testing environment  and get back to you if there is anything to be done.

Thank you again.

Gayan Samarakoon.