restricted local user

[grunky]

I have SEVERAL routers that need to have their running configs backed up automatically on a weekly - or at least monthly - basis.

I'm calling a shell script via cron thats doing this just fine. The only thing missing is some fine grain control what the user can do.

Now I have a local user defined in the router but its a full fledged user. I like to have an account that can ONLY use the copy command, ie 'copy running-config tftp://blah/blah/blah'.

Suggestions?

P.S. I tried to backup the running-config via a snmp query but that kinda fell through - no resources found.

[liviu.gheorghe]

The way to do this is to define a user with privilege level 2:

username xxx privilege 2 password yyy

Define an enable password for privilege level 2:

enable secret level 2 blabla

After that define what additional commands the user with privilege 2 has access to:

privilege exec level 2 copy

privilege exec level 2 copy startup-config

Cheers,

Liviu