I need to create a read only account on all of my cisco devices.. I haven't really been able to figure out exactly how as all the tutorials i can find on how to do this modifies the privilege 3 level and allows it to execute show command using an alias.. This is now what i want.

I basically want a user account that can login and perform every show command including show run, show ip interface brief, show interface status and so on, but without access to modify the configuration.. I don't care that the person can obtain information in the configuration that will make him or her able to access the router anyway, it is simply because i'am having someone access the equipment who needs to view certain information, but does not have enough knowledge that i trust him or her to make changes to the config..

Does anyone know how to do this without using Radius/TACACS?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 12, 2017 at 18:33

1 Answer 1


Without TACACS, you have to setup a privilege level ("view") that only allows the commands you want them to run. Allowing access to the full config may expose passwords to accounts that have higher access than they do -- eventually, they'll figure that out and bypass such weak controls.

TACACS is really the direction you need to move. However, I do understand not wanting that headache.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.