2

PacketTracer does not support the function of associating views with specific users, therefore I tried another approach.

My goal is to have two different users, one with privilege 15 and one with privilege 0. Privilege 0 user should only be able to use ping function and then logout.

I set it up accordingly:

username user1 privilege 0 secret cisco
username superuser privilege 15 secret cisco1

privilege exec level 0 ping

line console 0
login local

However when I login again and "show privilege" both users has level 15 and can perform all of the tasks. This is obviously a big security flaw. Am I missing something simple here? I also tried to adding a password to console 0, all to no avail

2

I entered the same configuration, and I got the same results. Then I added another user "user2" with privs 0. But I didn't specify and commands to use.

I then logged in as user1 and used ping without entering "enable" and the ping went through just fine. But when I logged in as user2, I couldn't use ping. From what I can tell, when a user uses "enable", it gives them 15 priv. The priv level you set when making that user is the level of privilege they have without using enable.

If you want to enforce these privs on these users, disable their use of the enable command.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.