here is how you do it.
1- create an account name "ciscotest"
2- create a group name "test" and assign the following properties:
group = regular {
cmd = enable { deny .* }
cmd = show { deny .* }
cmd = show { permit .* }
cmd = copy { permit .* }
cmd = ping { permit .* }
cmd = configure { deny .* }
cmd = disable { permit .* }
cmd = telnet { permit .* }
cmd = disconnect { permit .* }
cmd = where { permit .* }
cmd = set { permit .* }
cmd = clear { permit line }
cmd = exit { permit .* }
cmd = debug { permit .* }
3- assign user ciscotest to group test
now user ciscotest will not be able to get into "enable" mode. When user ciscotest types "enable", they will get a command not allowed.
Easy right?
