How to stop automatic entry as privileged exec from console login?

Question

I am configuring my Cisco router and trying to set up access levels. I was under the impression that level 0 was a very limited mode which almost only allows users to enter the enable command to enter privileged exec. However, I'd expect that if priviliged exec had a password set, that it wouldn't just let me access it without a password, but this seems to be the case.

I did the following:

router#config t
router(config)#enable secret somePass
router(config)#line 0
router(line-config)#password passForConsole
router(line-config)#login
router(line-config)#exit
router(config)#exit
router#disable
router exit

And I'd expect that after trying to log back in, the password would only grant console access, but it is always logging in as privileged exec router#, so it's bypassing my privileged exec password

Why is this happening and how can I change this?

Answer 1

Under line you can define the default privilege level that user will get into when logging. Users could later escalate their privilege using enable. Keep in mind you have different line options (console, vty, etc)

To answer your question - you can simply do privilege level 1 under line settings of the method you want to configure (virtual/console).

For further reference check out this paper.