11-05-2008 11:31 PM - edited 03-12-2019 05:58 PM
Hi,
Newbie here with a few questions. I've recently moved away from a call center job (phew!) and moved into a position which requires me to configure/deploy ASA5505 devices. Although I feel at ease with basic deployment and basic ACLs, I ran into a few things which have my scratching my head. I started looking into creating additional usernames on an ASA5505. So I create a username "godine" and didn't assign it a privilege level, therefore by default it gets privilege level 2:
ciscoasa5505# show run all username
username godine password XXXXXXX encrypted privilege 2
Why is it that even with that user, I'm able to run commands that require a privilege level of 15? As an example:
ciscoasa5505# show run all privilege | grep pwd
privilege cmd level 15 mode exec command pwd
From that information, it seems that "pwd" requires level 15 acess, however, I'm currently logged in with the user "godine" and when I run pwd:
ciscoasa5505# pwd
disk0:/
Furthermore, what is the purpose of "service-type admin" under username XXXX attribute.
Thanks in advance for all the responses!
Erik
11-06-2008 12:22 AM
Are you sure you are logged in with the user "godine" when issuing command
ciscoasa5505# show run all privilege | grep pwd
11-06-2008 12:54 AM
Since the username "godine" isn't an accepted username when SSH'ing to the device, I first logged in with pix. Once logged in with pix, I use the "login" command and login with godine. My understanding of things is, that if I would like to login with godine via SSH (without using the pix username) I'd have to use AAA instead of the local database.
11-06-2008 01:46 AM
Use this command, so that it uses local DB for authentication. Then login with the priv 2 user "godine"
aaa authentication ssh console LOCAL
11-06-2008 09:40 AM
I'm already logging in with username "godine". At no time do I ever type the command "enable". Thanks for your input.
11-07-2008 12:56 AM
So with some digging around, I found an answer to my question. access levels (1-15) aren't relevant much unless you authorize command authorization:
aaa authorization command LOCAL
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: