Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Note: All password have been replaced or redacted.

I'm trying to create a (rancid repo) account that can use the command "show run" without enabling and using a second password.

Right now, I add user lion with the command "username lion privilege 15 secret raplegend" but when I login as that user with password raplegend, I can't do the "sh run" command without doing

enable

password: reggaegod

Here are the relevant parts of the running-config file. I have replaced password hashes with fake plaintext for convenience.

version 12.2

enable secret 5 [redacted]
!
username snoop privilege 15 secret 5 raplegend
username lion privilege 15 secret 5 raplegend
aaa new-model
!
line con 0
line vty 0 4
 password 7 reggaegod
 transport input ssh
line vty 5 15
 password 7 reggaegod
 transport input ssh
!

What am I missing here? Thanks!

share|improve this question
1  
I think your problem is that you have snoop as one user and lion as another, when snoop lion is actually a single individual. –  MDMarra Aug 8 '12 at 17:33

2 Answers 2

up vote 4 down vote accepted

I tested this quickly on 12.2(46a), and I needed to add the following to make it work:

aaa authorization exec default local

Of course, if you're using more than just local accounts (e.g. TACACS+), you'll need to modify the statement to accommodate those accounts. Make sure you test it with another SSH session before logging out of the first one, because you won't be able to login to fix it if it doesn't work.

Also, since aaa new-model is configured, the default configuration for VTY lines is the equivalent of the old local local command, so the password commands should not be needed.

share|improve this answer
    
You can also do the same thing with line vty 0 4 priviledge level 15 –  Bad Dos Aug 8 '12 at 19:10
    
@Bad Dos - That will grant level 15 access to all users, regardless of what they're configured for. –  James Sneeringer Aug 8 '12 at 20:31

If you're using TACACS or RADIUS then you'll need to pass an av-pair value back for that account to be automatically escalated to enable level. Google TACACS av-pair.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.