Running copy running-config tftp with least privilage

[giridar]

Hi All,

 I am planning to backup device configuration using ManageEngine OpManager, it has a tftp server and we can add the devices, so it requires a credentials

the user account should be able to run copy running-config tftp, as I checked this command is only available for privilege 15

i don't want to use a privilage 15 user account for this to avoid any risks, since it has permission to modify the device configurations

is there any way to assign copy running-config tftp to a least privilege level

enable secret is already configured so i can't reduce the level of it and assign the exce 

thanks in advance 

[balaji.bandi · Accepted solution]

Try below and let us know how it goes :

#username backupuser privilege 7 password 7 backupuserpassword

#privilege exec level 7 copy running-config

[giridar]

thank you very much, will this copy all the configurations or only the ones that this level have access

[balaji.bandi]

The backupuser with Priv 7 - backupuser have access to that command only. - its like Role based access.

[giridar]

thank you, 

[giridar]

seems like the application I am using is taking the backup using show running-config and show startup-config

so I added these

privilege exec level 7 terminal length 0
privilege exec level 7 show running-config
privilege exec level 7 show startup-config

so it needs an account that has access to all the cinfigurations

is it possible to give full access except for configuration terminal

[balaji.bandi]

You can also do less priv level -

Since you do not provide the device information or IOS  - high level you can do as below

username bbandi privilege 5 secret 5 YYYYYYYYYYYYYYYYYYY

privilege exec level 5 show running-config view full
privilege exec level 5 show running-config view
privilege exec level 5 show running-config
privilege exec level 5 show