CLI based Roles/Views

Question

Hi Guys,
I'm trying to configure a view that will allow a user access to do a few mundane tasks such as read the startup conifg, a few show commands, change the terminal settings, etc.
I've configure a view called RO and assigned a few exec commands (see below):
parser view RO
secret 5 $1$m3Iz$ltDKR58NxImIZEEwX/vbV0
commands exec include terminal length
commands exec include terminal
commands exec include show startup-config
commands exec include show
I've also created a user and assigned it to this view
username sc view RO password 0 sc
Now, when I login with the user sc I am unable to move from user mode to privliged mode, I get an access denied error as seen below:
R1>en
Password:
% Access denied
Have I done something wrong? How do I configure the router so that I can create a role with the required commands and assign it to users? I thought I had it down pat but it isnt working.
Any advice you have would be greatly appreciated
TIA
Rgds
Scott

Answer 1

Hi Wen,
See config extract below:
VIEWS_R1#sho run
Building configuration...
Current configuration : 1218 bytes
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname VIEWS_R1
boot-start-marker
boot-end-marker
enable password password
aaa new-model
aaa authentication login default local
aaa authorization exec default if-authenticated
no ip domain lookup
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
username sc privilege 15 password 0 abc123
username sc2 view RO password 0 abc123
interface FastEthernet0/0
ip address 10.0.0.1 255.0.0.0
duplex auto
speed auto
line con 0
logging synchronous
line aux 0
line vty 0 4
transport input telnet
line vty 5 14
transport input telnet
line vty 15
transport input telnet
parser view RO
secret 5 $1$E6ex$JrkjcJd94q4vM/QrQL9F31
commands exec include terminal length
commands exec include terminal
commands exec include show startup-config
commands exec include show
end
Note: This config differs slightly from that mentioned in my previous posts. I've had to rebuild it as I lost my test environment. In the above config, the user sc2 is assigned the view RO. I'm doing all this testing in GNS3, happy to upload the configs for you if you prefer.
A difference I have noticed between your output and what I get is that my user "sc2" is not logged into privilged mode. I guess this is because I dont have it set on the vty lines. If I do set it, as already stated, the view doesnt take affect and the user gets all commands available to that priv level.
Heres what I see (I've added the passwords so you can see waht I'm doing):
User Access Verification
Username: sc2 (this user has the RO view assigned to them)
Password: abc123
VIEWS_R1>en
Password: RO (the RO view enable password)
% Access denied
VIEWS_R1>en
Password: password (the root view enable password)
VIEWS_R1#sho parser view
No view is active ! Currently in Privilege Level Context
VIEWS_R1#sho run | i sc2
username sc2 view RO password 0 abc123
VIEWS_R1#
Any idea why my view isnt taking affect?
Rgds
Scott