Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

It is possible to define a privilege level on a Cisco router so that another user can run every command including the enable mode but not create or modify user accounts? How?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

Actually the answer you selected is wrong: there is a way to do it locally.

http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gtclivws.html

It's called Cisco Views and you can tweak who can do what without the need for a server.

share|improve this answer
    
This perfectly answers my issue where I have a very small scale network with no option to use RADIUS or TACACS. –  3d1l Oct 2 at 0:11

No. The privilege levels are predefined by Cisco and on the router itself there is not much in terms of editing that functionality.

What you can do though is setup TACACS and use that to authenticate. Then you can more easily define what functions certain accounts or groups can do. I do not have much experience with TACACS but I do know that accounts and groups are essentially role based and allowed certain functions based on assigned roles.

TACACS, I think, acts as the authenticator for people trying to login. So authentications are essentially passed to the server with TACACS installed.

share|improve this answer
    
We implemented a similar scheme with a RADIUS server, which had its own set of credentials and therefore, cisco users weren't able to add new users, in case a non-proprietary solution is desirable. –  Nevin Williams Apr 18 '13 at 20:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.