local user and privilege levels

[Bruce Summers]

hi folks,

need some confirmation.  I have FWSM's in Cat 6513's.

I have a need to be able to session from the swtich to the FWSM by using default account (not local user), at privilege level 15

I further have a need to allow a user read only access by ssh'n into the FWSM...

I believe I need to setup a local user, at, say privilege level 5, assign the show command only to priv level 5, then set the authorization command for that user.

So, i think my command sets are as follows to accomplish this

username <username> password <pw> priv 5

priv command level 5 mode exec command show

aaa auth ssh console LOCAL

aaa auth enable console LOCAL

aaa authorization command LOCAL

i think, an please correct me if i'm wrong, that this will allow the user at priv 5 to run only the show command and only by SSH to the FWSM while allow the priv 15 level default login to continue to function properly.

thanks for the help

[Parminder Sian]

Hi Bruce,

I dont know how deep you actually wanna dive into this, however if you are looking for full blown command authorization, your best bet would be to use ACS for this.

Here's a link for your help:-

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml

Hope this helps.

Parminder Sian