Cisco routers provides you an option to set custom privilige levels on specific IOS commands. This can be achieved from the IOS functionality of the Cisco devices without using any TACACS or RADIUS server. To reduce the privilege level of an enable command from 15 to
1, use the following command:
Router1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router1(config)#privilege exec level 1 show startup-config
Router1(config)#end
Router1#
You can also increase the privilege level of a level 1
command:
Router1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router1(config)#privilege exec level 15 show ip route
Router1(config)#privilege exec level 1 show ip
Router1(config)#privilege exec level 1 show
Router1(config)#end
Router1#
Note that raising the privilege level of the
show ip
route command also increased the
level of the
show ip set of commands and all of the other
show
commands. In this example, we lowered the
show ip and
show
commands back to privilege 1 to ensure that all of the other
show
commands operated normally.
Cisco routers support 16 privilege levels ranging from 0 to 15.
By default, Cisco assigns commands to only three of these privilege levels:
zero, user, and enable. There are five commands with privilege level zero:
disable, enable, exit, help, and logout. The user level (privilege level 1) has
a wide variety of commands available that cannot alter the router's
configuration. Enable mode (privilege level 15), by contrast, allows complete
access to all router commands.
In practical terms, only levels 1 and 15 are normally used.
When you first access the router using your VTY password (or local
authentication), the router assigns privilege level 1 to your session. In order
to access privilege level 15, you must use the enable EXEC command:
Router1>show privilege
Current privilege level is 1
Router1>enable 15
Password:
Router1#show privilege
Current privilege level is 15
Router1#
You can specify any valid privilege level with the
enable
command, but the default is level 15.
You can also reduce the privilege level of your current session with the
disable command:
Router1#show privilege
Current privilege level is 15
Router1#disable 1
Router1>show privilege
Current privilege level is 1
Router1>
The disable command will default to privilege level 1 if
you don't specify a target privilege level.
By default, Cisco assigns a subset of commands to privilege 1
and the full set of commands to privilege 15. However, the default commands for
each privilege level may not be appropriate for your organization. Many
organizations find it useful to modify the default command privileges.
The first example shows how to change the
privilege level of the show start-config from its default privilege value
of 15, giving it a new value of 1. This allows normal unprivileged users to see
the router's startup configuration without having to give them full enable
access in the process. People usually use this feature to reduce the privilege
of certain key commands. By allowing normal users to access the few commands
that they need, this feature allows you to keep tighter restrictions on the
commands that change the router's configuration.
Although you can change the privilege mode of any router
command, the
show running-config
command does not function correctly at levels below 15:
Router1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router1(config)#privilege exec level 1 show running-config
Router1(config)#end
Router1#disable
Router1>show running-config
Building configuration...
Current configuration : 85 bytes
!
! Last configuration change at 22:02:36 EDT Sun Jul 7 2002 by ijbrown
!
!
!
!
end
Router1>
Although the router permits the command to execute, the output
is unusable.
The second example shows how to increase the privilege
level of a command (show ip route) from 1 to 15. This will prevent
user-level staff from viewing the routing table. The NSA guide to Cisco security
recommends that administrators increase the privilege level of the connect,
rlogin, telnet, show ip access-lists, show access-lists, and show logging
commands from 1 to 15:
Router1#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router1(config)#privilege exec level 15 connect
Router1(config)#privilege exec level 15 rlogin
Router1(config)#privilege exec level 15 telnet
Router1(config)#privilege exec level 15 show ip access-lists
Router1(config)#privilege exec level 15 show access-lists
Router1(config)#privilege exec level 15 show logging
Router1(config)#privilege exec level 1 show
Router1(config)#privilege exec level 1 show ip
Router1(config)#end
Router1#
Note that changing the privilege level of the show ip route
command from 1 to 15 also increases the privilege level of all show
ip and show commands to 15. So, in this example, we have explicitly
reduced the privilege of these commands back to level 1 so that we don't lose
access to all of the other show commands.