can u do show run without using the enable?

[ja1064]

i have an lan admin who just went through a boot camp and would like to be able to 'see' his router config so he has asked for the enable. I'm not willing to give it to him. Is there any way to give a level of access that would allow someone the ability to do a show run without using the enable. Seems unlikely but maybe there is some magic out there.

and the obvious option of just sending him the config isn't satisfying him - but then he's a pain about everything else

[tdrais]

You can change the security level of most commands. You just to put him in a level less than 15 and then move the commands to that. It is possible to make it so that he can only see parts of the run and not others. I used to have a link to a noncisco site with examples but it is broken.

[farkascsgy]

Try with the following:

username readuser privilege 7 secret xxxxxxxx

privilege exec level 7 show startup-config

privilege exec level 7 show running-config

privilege exec level 7 show (with this command you can define what command is accessible).

It should be work.

Bye

FCS

[eugeniodesideri]

is it possible to have a downgrade permission for that command in ASA 9.2 as well?

[Runtal]

If anyone's still interested on newer devices:

You need following lines: (privilege level you can choose, example uses 5, as this user is already very limited, you should not go higher, as you give access to the disk and other commands should be restricted/not available if possible)

username Reader privilege 5 secret UseYourOwnPassword

file privilege 5

privilege exec level 5 show startup-config

privilege exec level 5 show running-config view full

privilege exec level 5 show running-config view

privilege exec level 5 show running-config

privilege exec level 5 show

This will enable to show the running configuration with "show running-config view full" and the startup configuration with "show startup-config"

[paul driver]

Hello

No you cannot, you need to be in at least user exec mode and have the correct privilege to run the command.

[Richard Burts]

The original post is pretty old. But is asks an interesting question about whether you can let an admin see the config but not be able to change anything. There have been several posts about changing security levels but this is cumbersome and difficult to really get right. There is probably an easier solution. Let the admin use show startup. I have always been puzzled why Cisco is so very protective about access using show run but not so protective about show startup.