Cisco – Privilege configuration on cisco switch

ciscocisco-ios

I have a Cisco switch who have an user configured with privilege level 3 configured as below

! the user can configure an interface 
privilege configure level 3 interface
privilege exec level 3 configure terminal
privilege exec level 3 configure

I wonder how can I get him the privilege to execute the following command.

the goal :

copy run tftp:XXX

by curiosity :

show run

EDIT: I found the answer for the first copy run tftp:XXX add the following command

privilege exec level 3 copy

If anyone know how to view the show run will be great.

Best Answer

http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a00800949d5.shtml probably answers your question:

privilege exec level 3 show running

Related Solutions

Cisco Router Telnet Connection Refused

The issue has been resolved. When I checked the running configuration on the router, I noticed I have the line below under the line vty 0 4

access-list class 23 in

All I had to do was to negate the command and everything went back to normal.

Thanks all for your support.

Cisco-IOS AAA – Reason for ‘aaa authorization exec default group tacacs+’ Command in Cisco IOS

The statement

aaa authorization exec default group tacacs+

allows you to start a CLI session (a command shell). Without it, you can't get a command prompt.

You can see more information here.

EDIT: From: http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_cfg_authorizatn.html#wp1058237

AAA Authorization Types

Cisco IOS software supports five different types of authorization: •Auth-proxy—Applies specific security policies on a per-user basis. See "Related Documents" section for more information about where to find authentication proxy configuration documentation.

•Commands—Applies to the EXEC mode commands a user issues. Command authorization attempts authorization for all EXEC mode commands, including global configuration commands, associated with a specific privilege level.

•EXEC—Applies to the attributes associated with a user EXEC terminal session.

•Network—Applies to network connections. This can include a PPP, SLIP, or ARAP connection.

•Reverse Access—Applies to reverse Telnet sessions.

•Configuration—Applies to downloading configurations from the AAA server.

•IP Mobile—Applies to authorization for IP mobile services.

I think the confusion comes from the difference in how different TACACS daemons respond. Cisco ACS may respond differently than your Shrubbery daemon or tacacs.net.

Here is some more reference material, although not exactly what you're asking for: TACACS Attribute-Value Pairs

Best Answer

Related Solutions

Cisco Router Telnet Connection Refused

Cisco-IOS AAA – Reason for ‘aaa authorization exec default group tacacs+’ Command in Cisco IOS

Related Topic