Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On a Cisco ASA is there any way to provide a user with access to admin features (view/change the config) without providing the main enable password?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

You could use the local user database on the ASA applicance to create usernames and passwords with the privilege levels you want the users to have upon login.

Here is how to create local users:

hostname>enable
hostname#configure terminal
hostname(config)#username [UserName] privilege 15 password [PasswordHere]    //privilege level 15 is root (admin) access.

//The below commands make sure the username/password login method will apply to both console and vty lines. If you have an AUX port make sure to include it aswell.
hostname(config)#line con 0
hostname(config-line)#login local
hostname(config-line)#exit
hostname(config)#line vty 0 15
hostname(config-line)#login local
hostname(config-line)#exit
hostname(config)#exit

The above is just a sample configuration. If you are not to expirienced with the command line make sure to check the documentation if you are unsure about what a command does.

share|improve this answer
    
This works for router and switches but not ASAs. –  evolvd Nov 14 '11 at 14:51
add comment

When you log in from a TACACS account, you have to type your own password twice (once at connection and once at enable). I imagine this works as well for RADIUS accounts.

share|improve this answer
    
This also applies if you use a local login –  evolvd Nov 14 '11 at 14:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.