Bypass need for enable password?

devin.noel · ‎05-20-2010

How do you let a user acutomatically go to enable mode without the enable password? We are using aaa new-model authentication with local non-tacacs logins. All of the admins have their own username/pass to login, but I'd like to bypass the need to hand out the enable password to everybody. I'm pretty sure I remember being able to grant people with level 15 access direct access to enable commands, but don't remember how.

aaa new-model
aaa authentication login default local enable

username john privilege 15 password 7 ...........

Edison Ortiz · ‎05-20-2010

You need authorization, something like this:

aaa authorization exec default local if-authenticated

devin.noel · ‎05-20-2010

http://www.dslreports.com/faq/9815

Sample #2 worked.