Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

At work there is a new cisco device that was recently installed. There are configs for users to modify interfaces at priv 10, but nothing defined for any other priv levels. There is an enable level 10 secret and an enable secret. When anyone logs in and runs en 10 they are prompted for a password. When they run en they are prompted for a password, however they can run en 11 and any other number up to 14 without a password and are given access to all of the commands that priv 10 has access to. This doesn't seem right to me. Can any point me in the right direction to give people a kick back and log the failed attempt if they attempt access to priv 11 on up? Or am I just going to have to set a password for all of those priv levels?

share|improve this question
1  
What kind of "device"? Sounds like an ASA (PixOS). Cisco has made 3 different device OSes and they all have subtle differences, like security. –  Chris S Apr 24 '12 at 12:33

1 Answer 1

If all you want is to force everybody to use a password, issue no enable 10 in config mode.

Refer to http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide/scfpass.html#wp1001016 for details on how to protect privileged EXEC commands.

share|improve this answer
    
It doesn't accept no enable 10 in the configuration terminal. –  darkdragn Apr 24 '12 at 10:11
    
I found what I needed. The guys that did the install didn't put any authorization statements. I just did aaa authorization exec default local then took away enable from anyone under priv 11 with privilege exec level 11 enable Now no one under level 11 can elevate them selves, and everyone starts out at their priv, removing the need for the enable set. Thanks for taking a look and trying, adaptr! I appreciate the attempt. –  darkdragn Apr 24 '12 at 10:47
    
Oh well, nobody like Cisco for being inconsistent! –  adaptr Apr 24 '12 at 12:47

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.