Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I thought I could get this done by doing the following:

privilege cmd level 6 mode exec command user

But under a user with that priv level the user can only do the following

user newuser

They can't assign a password and priv level.

Maybe there is a better / another way to do this?

share|improve this question
Could you explain the reason for wanting this? TACACS+ or RADIUS may be better options. – Adam Jun 16 '11 at 19:23
I was trying to think of the fastest way to give a client the ability to do this (to manage vpn users). I found out we have enough time to implement a RADIUS service so that will be the path. – evolvd Jun 16 '11 at 22:50
up vote 0 down vote accepted

In exec mode, user expands to user-alert; this isn't what you want.

You're probably looking for something more along these lines:

privilege cmd level 6 mode configure command username

And then possibly some allowances for config-username mode:

privilege cmd level 6 mode username command service-type
privilege cmd level 6 mode username command group-lock

But that's worthless as anything other than a thought exercise. If I'm a restricted level 6 user, and I'm allowed to run the username command in configure mode, then I can create myself a level 15 user; it's just a waste of effort to put a completely ineffective restriction in place. Adam's exactly right, TACACS+ should be used for this.

share|improve this answer
Agh well that explains it! Good to know at least. – evolvd Jun 16 '11 at 22:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.