Command associations with privilege levels in Cisco IOS

Question

As I understand, by default, IOS has three privilege levels: 0, 1 and 15. Privilege level 0 has six available commands:

r1>?
Exec commands:
  <1-99>   Session number to resume
  disable  Turn off privileged commands
  enable   Turn on privileged commands
  exit     Exit from the EXEC
  help     Description of the interactive help system
  logout   Exit from the EXEC

r1>

Privilege level 1 has few dozen available commands and privilege level 15 has all the possible commands for particular IOS release.

First, is my understanding of privilege levels as I outlined so far correct?

Are all the commands by default divided by those three privilege levels?

Does privilege level 1 include all the commands in privilege level 0 and privilege level 15 includes all the commands in privilege level 1?

Answer 1

for the first part of your question

For Cisco device There are 16 privilege levels 3 of them are default and the other are configurable . the default as you said

Privilege level 0 — includes the disable, enable, exit, help, and logout commands.
Privilege level 1 — Normal level on Telnet; includes all user-level commands at the router> prompt.
Privilege level 15 — includes all enable-level commands at the router# prompt.

*Commands available at a particular level in a particular router can be found by typing a ? at the router prompt. *

Router>show privilege
Current privilege level is 1
Router>enable 5
Password: level-5-password
Router#show privilege
Current privilege level is 5
Router#

You can configure whatever privilege you need with whatever commands you allow by using the privilege command as illustrated.

privilege mode {level level command | reset} command

the highest privilege level can execute commands that associated to it plus the the command associated to the lower privilege

example
username user_9 privilege 9 password pass_1
username user_6 privilege 6 password pass_6
username user_15 privilege 15 password pass_15

privilege configure level 8 snmp-server community
privilege exec level 6 show running
privilege exec level 8 configure terminal

User user_6 is able to Telnet in and execute the show run command, but the resulting configuration is virtually blank because this user cannot configure anything (configure terminal is at level 8, not at level 6). The user is not permitted to see usernames and passwords of the other users, or to see Simple Network Management Protocol (SNMP) information.

User user_9 is able to Telnet in and execute the show run command, but only sees commands that he can configure (the snmp-server community part of the router configuration, since this user is our network management administrator). He can configure snmp-server community because configure terminal is at level 8 (at or below level 9), and snmp-server community is a level 8 command. The user is not permitted to see usernames and passwords of the other users, but he is trusted with the SNMP configuration.

Answer 2

From Cisco IOS 15SY, User Security Config Guide:

Cisco IOS Privilege Levels

The default configuration for Cisco IOS software-based networking devices uses privilege level 1 for user EXEC mode and privilege level 15 for privileged EXEC. The commands that can be run in user EXEC mode at privilege level 1 are a subset of the commands that can be run in privileged EXEC mode at privilege 15.

So Priv 15 can do anything. Priv 1 can do anything that doesn't require enable mode.

I understand this is a roundabout, reversed answer to your question, but it's the standard one. I know of no canonical list for either category.

To give a little more info, here's what I get from my C2960 running IOS Version 12.2(50r)SE1:

Device>?
Exec commands:
  <1-99>           Session number to resume
  access-enable    Create a temporary Access-List entry
  access-profile   Apply user-profile to interface
  clear            Reset functions
  connect          Open a terminal connection
  crypto           Encryption related commands.
  disable          Turn off privileged commands
  disconnect       Disconnect an existing network connection
  enable           Turn on privileged commands
  exit             Exit from the EXEC
  help             Description of the interactive help system
  lock             Lock the terminal
  login            Log in as a particular user
  logout           Exit from the EXEC
  name-connection  Name an existing network connection
  ping             Send echo messages
  rcommand         Run command on remote switch
  release          Release a resource
  renew            Renew a resource
  resume           Resume an active network connection
  set              Set system parameter (not config)
  show             Show running system information
  ssh              Open a secure shell client connection
  systat           Display information about terminal lines
  tclquit          Quit Tool Command Language shell
  telnet           Open a telnet connection
  terminal         Set terminal line parameters
  traceroute       Trace route to destination
  tunnel           Open a tunnel connection
  where            List active connections

Device>