USERNAME WITH PRIVILEGE 15

[estelamathew]

Hello Dear's,

I have created a user with command username cisco privilege 15 password cisco when he telnet to the switch he is asked for the enable secret passwrd why??????

Thanks

[lgijssel]

Hello Estela,

Can you please post a capture of the login dialog?

It would help to see where exactly this situation occurs.

Please also provide the config lines involved and the platform on which you are having this issue.

(pix/asa, router or switch) eventually including version info.

regards,

Leo

[estelamathew]

Hello,

please find the Attached  configs

login as: cwlms
cwlms@192.168.4.250's password:

SWITCH>en
Password:

Thanks

[lgijssel]

The attachment is in queued state and cannot be opened.

Still I think you may be missing some aaa config lines.

Can you fix or retry the attachment?

regards

Leo

[Nagaraja Thanthry]

Hello,

By default the VTY lines have a privilege level of "0". Please try the following:

line vty 0 4

privilege level 15

exit

Now, if you login, you should be able to get directly into the enable mode.

Hope this helps.

Regards,

NT

[estelamathew]

Hello,

This will allow everybody in privilege 15???? I don't want everybody to access on level 15 i have certain users on different privilege levels

Thanks

[Dan-Ciprian Cicioiu]

do you have any "aaa" configuration on the switch ? or just using login local under the line vty?

Can you try to paste here the line configuration , it seams that there is a problem with attached config.

Dan

[Nagaraja Thanthry]

Hello,

The user privilege takes precedence over the line privilege. So, if the user has a lower privilege level, that should override the line privilege.

Hope this helps.

Regards,

NT

[Dan-Ciprian Cicioiu]

Yes , but if it has aaa authorization , it is normal to check the enable even if there is any default privilege.

Dan

[estelamathew]

Hello,

NO user level does'nt take precedence i tried just now, It put user level 2 also in level 15.

There is no AAA,it is local authentication.

line con 0
line vty 0 4
access-class YOU_ME in
exec-timeout 5 0
password 7 08364D5D1D1C1216060E1E25
login local
transport input ssh
line vty 5 15
exec-timeout 5 0
no login
transport input ssh

[lgijssel]

Local authentication is one thing but assigning a privilege level falls under authorization.

Please check this link on aaa, I hope this will enable you to configure a solution.

http://www.cisco.com/en/US/docs/security/asdm/6_2/user/guide/aaasetup.html#wp1284305

It should be something like:

aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius local

but then without the radius stuff.

regards,

Leo

[Dan-Ciprian Cicioiu]

Hi Leo ,

Here it is :

Router#sh run | i aaa
no aaa new-model
Router#
Router#
Router#sh run | b line
line con 0
login local
line aux 0
line vty 0 4
!
!
end

Router#sh run | i user
username c privilege 15 secret 5 $1$k/W8$yvjhRXM7TQDaRhQGLanSR1
Router#

Router#exi

Router con0 is now available

Press RETURN to get started.

User Access Verification

Username: c
Password:
Router#sh priv
Current privilege level is 15
Router#

Dan

[estelamathew]

Hello Leo,

It can be done without AAA also,

I have 1 switch in my network in which i m accessing directly in privilege (#) mode.

Thanks

[lgijssel]

It can be done without an AAA-server but you need something similar to the few lines proposed to make it work with local authentication/authorization. This is because you normally login to level1 and then need the additional enable pw to go to level 15. You want to modify the default behavior and this requires additional config.

regards,

Leo

[cadet alain]

Hi Leo,

It can be done without an AAA-server but you need something similar to 
the few lines proposed to make it work with local 
authentication/authorization

I already did it like the OP without any problem but on some platforms/ IOS it didn't work so it can be done without AAA

Regards.

Alain.