Previous section   Next section

Recipe 3.21 Changing the Privilege Level of IOS Commands

3.21.1 Problem

You want to change the privilege level of specific IOS commands.

3.21.2 Solution

To reduce the privilege level of an enable command from 15 to 1, use the following command:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#privilege exec level 1 show startup-config
Router1(config)#end
Router1#

You can also increase the privilege level of a level 1 command:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#privilege exec level 15 show ip route
Router1(config)#privilege exec level 1 show ip
Router1(config)#privilege exec level 1 show
Router1(config)#end
Router1#

Note that raising the privilege level of the show ip route command also increased the level of the show ip set of commands and all of the other show commands. In this example, we lowered the show ip and show commands back to privilege 1 to ensure that all of the other show commands operated normally.

3.21.3 Discussion

Cisco routers support 16 privilege levels ranging from 0 to 15. By default, Cisco assigns commands to only three of these privilege levels: zero, user, and enable. There are five commands with privilege level zero: disable, enable, exit, help, and logout. The user level (privilege level 1) has a wide variety of commands available that cannot alter the router's configuration. Enable mode (privilege level 15), by contrast, allows complete access to all router commands.

In practical terms, only levels 1 and 15 are normally used. When you first access the router using your VTY password (or local authentication), the router assigns privilege level 1 to your session. In order to access privilege level 15, you must use the enable EXEC command:

Router1>show privilege
Current privilege level is 1
Router1>enable 15
Password: 
Router1#show privilege
Current privilege level is 15
Router1#

You can specify any valid privilege level with the enable command, but the default is level 15. You can also reduce the privilege level of your current session with the disable command:

Router1#show privilege
Current privilege level is 15
Router1#disable 1
Router1>show privilege
Current privilege level is 1
Router1>

The disable command will default to privilege level 1 if you don't specify a target privilege level.

By default, Cisco assigns a subset of commands to privilege 1 and the full set of commands to privilege 15. However, the default commands for each privilege level may not be appropriate for your organization. Many organizations find it useful to modify the default command privileges.

The first example in this recipe shows how to change the privilege level of the show start-config from its default privilege value of 15, giving it a new value of 1. This allows normal unprivileged users to see the router's startup configuration without having to give them full enable access in the process. People usually use this feature to reduce the privilege of certain key commands. By allowing normal users to access the few commands that they need, this feature allows you to keep tighter restrictions on the commands that change the router's configuration.

Although you can change the privilege mode of any router command, the show running-config command does not function correctly at levels below 15:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#privilege exec level 1 show running-config
Router1(config)#end
Router1#disable
Router1>show running-config 
Building configuration...
   
Current configuration : 85 bytes
!
! Last configuration change at 22:02:36 EDT Sun Jul 7 2002 by ijbrown
!
!
!
!
end
   
Router1>

Although the router permits the command to execute, the output is unusable.

The second recipe example shows how to increase the privilege level of a command (show ip route) from 1 to 15. This will prevent user-level staff from viewing the routing table. The NSA guide to Cisco security recommends that administrators increase the privilege level of the connect, rlogin, telnet, show ip access-lists, show access-lists, and show logging commands from 1 to 15:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#privilege exec level 15 connect
Router1(config)#privilege exec level 15 rlogin 
Router1(config)#privilege exec level 15 telnet
Router1(config)#privilege exec level 15 show ip access-lists
Router1(config)#privilege exec level 15 show access-lists   
Router1(config)#privilege exec level 15 show logging     
Router1(config)#privilege exec level 1 show         
Router1(config)#privilege exec level 1 show ip
Router1(config)#end
Router1#

Note that changing the privilege level of the show ip route command from 1 to 15 also increases the privilege level of all show ip and show commands to 15. So, in this example, we have explicitly reduced the privilege of these commands back to level 1 so that we don't lose access to all of the other show commands.

3.21.4 See Also

Recipe 3.22; Recipe 3.23


  Previous section   Next section
Top