Cisco IOS Cookbook, 2nd Edition

Defining Per User Privileges

Problem

You want to set different privilege levels to different users.

Solution

To assign a particular privilege level to user, use the following set of commands:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#aaa new-model
Router1(config)#aaa authentication login default local
Router1(config)#aaa authorization exec default local 
Router1(config)#username slowell privilege 10 password maceng#1
Router1(config)#privilege exec level 10 show ip route
Router1(config)#privilege exec level 1 show ip       
Router1(config)#privilege exec level 1 show   
Router1(config)#end
Router1#

You can also create several global privilege levels, which any user can access with the appropriate password:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#enable secret level 10 lvl10passwd
Router1(config)#privilege exec level 10 show ip route
Router1(config)#privilege exec level 1 show ip
Router1(config)#privilege exec level 1 show
Router1(config)#end
Router1#

Discussion

Sometimes having two privilege level groups doesn’t give fine enough granularity. For example, you might have three levels of administrators. The user-level staff members are not allowed to see the router’s routing table. The mid-level staff can see the routing table, but they aren’t allowed to make configuration changes. Only the highest-level engineers have access to everything.

You could accomplish this by using ...