cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
53739
Views
10
Helpful
24
Replies

USERNAME WITH PRIVILEGE 15

estelamathew
Level 2
Level 2

Hello Dear's,

I have created a user with command username cisco privilege 15 password cisco when he telnet to the switch he is asked for the enable secret passwrd why??????

Thanks

24 Replies 24

lgijssel
Level 9
Level 9

Hello Estela,

Can you please post a capture of the login dialog?

It would help to see where exactly this situation occurs.

Please also provide the config lines involved and the platform on which you are having this issue.

(pix/asa, router or switch) eventually including version info.

regards,

Leo

Hello,

please find the Attached  configs

login as: cwlms
cwlms@192.168.4.250's password:

SWITCH>en
Password:

Thanks

The attachment is in queued state and cannot be opened.

Still I think you may be missing some aaa config lines.

Can you fix or retry the attachment?

regards

Leo

Nagaraja Thanthry
Cisco Employee
Cisco Employee

Hello,

By default the VTY lines have a privilege level of "0". Please try the following:

line vty 0 4

privilege level 15

exit

Now, if you login, you should be able to get directly into the enable mode.

Hope this helps.

Regards,

NT

Hello,

This will allow everybody in privilege 15???? I don't want everybody to access on level 15 i have certain users on different privilege levels

Thanks

do you have any "aaa" configuration on the switch ? or just using login local under the line vty?

Can you try to paste here the line configuration , it seams that there is a problem with attached config.

Dan

Hello,

The user privilege takes precedence over the line privilege. So, if the user has a lower privilege level, that should override the line privilege.

Hope this helps.

Regards,

NT

Yes , but if it has aaa authorization , it is normal to check the enable even if there is any default privilege.

Dan

Hello,

NO user level does'nt take precedence i tried just now, It put user level 2 also in level 15.

There is no AAA,it is local authentication.

line con 0
line vty 0 4
access-class YOU_ME in
exec-timeout 5 0
password 7 08364D5D1D1C1216060E1E25
login local
transport input ssh
line vty 5 15
exec-timeout 5 0
no login
transport input ssh

Local authentication is one thing but assigning a privilege level falls under authorization.

Please check this link on aaa, I hope this will enable you to configure a solution.

http://www.cisco.com/en/US/docs/security/asdm/6_2/user/guide/aaasetup.html#wp1284305

It should be something like:

aaa new-model
aaa authentication login default group radius local
aaa authorization exec default group radius local

but then without the radius stuff.

regards,

Leo

Hi Leo ,

Here it is :

Router#sh run | i aaa
no aaa new-model
Router#
Router#
Router#sh run | b line
line con 0
login local
line aux 0
line vty 0 4
!
!
end

Router#sh run | i user
username c privilege 15 secret 5 $1$k/W8$yvjhRXM7TQDaRhQGLanSR1
Router#

Router#exi

Router con0 is now available

Press RETURN to get started.

User Access Verification

Username: c
Password:
Router#sh priv
Current privilege level is 15
Router#

Dan

Hello Leo,

It can be done without AAA also,

I have 1 switch in my network in which i m accessing directly in privilege (#) mode.

Thanks

It can be done without an AAA-server but you need something similar to the few lines proposed to make it work with local authentication/authorization. This is because you normally login to level1 and then need the additional enable pw to go to level 15. You want to modify the default behavior and this requires additional config.

regards,

Leo

Hi Leo,

It can be done without an AAA-server but you need something similar to the few lines proposed to make it work with local authentication/authorization

I already did it like the OP without any problem but on some platforms/ IOS it didn't work so it can be done without AAA

Regards.

Alain.

Don't forget to rate helpful posts.
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco