Table Of Contents
Prerequisites for Role-Based CLI Access
Restrictions for Role-Based CLI Access
Information About Role-Based CLI Access
View Authentication via a New AAA Attribute
How to Use Role-Based CLI Access
Configuring a Lawful Intercept View
Monitoring Views and View Users
Configuration Examples for Role-Based CLI Access
Configuring a CLI View: Example
Configuring a Lawful Intercept View: Example
Configuring a Superview: Example
Role-Based CLI Access
The Role-Based CLI Access feature allows the network administrator to define "views," which are a set of operational commands and configuration capabilities that provide selective or partial access to Cisco IOS EXEC and configuration (Config) mode commands. Views restrict user access to Cisco IOS command-line interface (CLI) and configuration information; that is, a view can define what commands are accepted and what configuration information is visible. Thus, network administrators can exercise better control over access to Cisco networking devices.
Feature History for Role-Based CLI Access
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Prerequisites for Role-Based CLI Access
•
Restrictions for Role-Based CLI Access
•
Information About Role-Based CLI Access
•
How to Use Role-Based CLI Access
•
Configuration Examples for Role-Based CLI Access
Prerequisites for Role-Based CLI Access
Your image must support CLI views.
Restrictions for Role-Based CLI Access
Lawful Intercept Images Limitation
Because CLI views are a part of the Cisco IOS parser, CLI views are a part of all platforms and Cisco IOS images. However, the lawful intercept view is available only in images that contain the lawful intercept subsystem.
Maximum Number of Allowed Views
The maximum number of CLI views and superviews, including one lawful intercept view, that can be configured is 15. (This does not include the root view.)
Information About Role-Based CLI Access
To create and use views, you should understand the following concepts:
•
View Authentication via a New AAA Attribute
Benefits of Using CLI Views
Views: Detailed Access Control
Although users can control CLI access via both privilege levels and enable mode passwords, these functions do not provide network administrators with the necessary level of detail needed when working with Cisco IOS routers and switches. CLI views provide a more detailed access control capability for network administrators, thereby, improving the overall security and accountability of Cisco IOS software.
As of Cisco IOS Release 12.3(11)T, network administrators can also specify an interface or a group of interfaces to a view; thereby, allowing access on the basis of specified interfaces.
Root View
When a system is in "root view," it has all of the access privileges as a user who has level 15 privileges. If the administrator wishes to configure any view to the system (such as a CLI view, a superview, or a lawful intercept view), the system must be in root view.
The difference between a user who has level 15 privileges and a root view user is that a root view user can configure a new view and add or remove commands from the view. Also, when you are in a CLI view, you have access only to the commands that have been added to that view by the root view user.
View Authentication via a New AAA Attribute
View authentication is performed by an external authentication, authorization, and accounting (AAA) server via the new attribute "cli-view-name."
AAA authentication associates only one view name to a particular user; that is, only one view name can be configured for a user in an authentication server.
How to Use Role-Based CLI Access
This section contains the following procedures:
•
Configuring a CLI View (required)
•
Configuring a Lawful Intercept View (optional)
•
Configuring a Superview (optional)
•
Monitoring Views and View Users (optional)
Configuring a CLI View
Use this task to create a CLI view and add commands or interfaces to the view, as appropriate.
Prerequisites
Before you create a view, you must perform the following tasks:
•
Enable AAA via the aaa new-model command. (For more information on enabling AAA, see the chapter "Configuring Authentication" in the Cisco IOS Security Configuration Guide, Release 12.3.
•
Ensure that your system is in root view—not privilege level 15.
SUMMARY STEPS
1.
enable view
2.
configure terminal
3.
parser view view-name
4.
secret 5 encrypted-password
5.
commands parser-mode {include | include-exclusive | exclude} [all] [interface interface-name | command]
6.
exit
7.
exit
8.
enable [privilege-level] [view view-name]
9.
show parser view [all]
DETAILED STEPS
Troubleshooting Tips
After you have successfully created a view, a system message such as the following will be displayed:
%PARSER-6-VIEW_CREATED: view `first' successfully created.After you have successfully deleted a view, a system message such as the following will be displayed:
%PARSER-6-VIEW_DELETED: view `first' successfully deleted.
You must associate a password with a view. If you do not associate a password, and you attempt to add commands to the view via the commands command, a system message such as the following will be displayed:
%Password not set for view <viewname>.Configuring a Lawful Intercept View
Use this task to initialize and configure a view for lawful-intercept-specific commands and configuration information. (Only an administrator or a user who has level 15 privileges can initialize a lawful intercept view.)
About Lawful Intercept Views
Like a CLI view, a lawful intercept view restricts access to specified commands and configuration information. Specifically, a lawful intercept view allows a user to secure access to lawful intercept commands that are held within the TAP-MIB, which is a special set of simple network management protocol (SNMP) commands that store information about calls and users.
Commands available in lawful intercept view belong to one of the following categories:
•
Lawful intercept commands that should not be made available to any other view or privilege level
•
CLI views that are useful for lawful intercept users but do not have to be excluded from other views or privilege levels
Prerequisites
Before you initialize a lawful intercept view, ensure that the privilege level is set to 15 via the privilege command.
SUMMARY STEPS
1.
enable view
2.
configure terminal
3.
li-view li-password user username password password
4.
username [lawful-intercept] name [privilege privilege-level | view view-name] password password
5.
parser view view-name
6.
secret 5 encrypted-password
7.
name new-name
DETAILED STEPS
Troubleshooting Tips
To display information for all users who have access to a lawful intercept view, issue the show users lawful-intercept command. (This command is available only to authorized lawful intercept view users.)
Configuring a Superview
Use this task to create a superview and add at least one CLI view to the superview.
About Superviews
A superview consists of one or more CLI views, which allow users to define what commands are accepted and what configuration information is visible. Superviews allow a network administrator to easily assign all users within configured CLI views to a superview instead of having to assign multiple CLI views to a group of users.
Superviews contain the following characteristics:
•
A CLI view can be shared among multiple superviews.
•
Commands cannot be configured for a superview; that is, you must add commands to the CLI view and add that CLI view to the superview.
•
Users who are logged into a superview can access all of the commands that are configured for any of the CLI views that are part of the superview.
•
Each superview has a password that is used to switch between superviews or from a CLI view to a superview.
•
If a superview is deleted, all CLI views associated with that superview will not be deleted too.
Adding CLI Views to a Superview
You can add a view to a superview only after a password has been configured for the superview (via the secret 5 command). Thereafter, issue the view command in view configuration mode to add at least one CLI view to the superview.
Note
Before adding a CLI view to a superview, ensure that the CLI views that are added to the superview are valid views in the system; that is, the views have been successfully created via the parser view command.
SUMMARY STEPS
1.
enable view
2.
configure terminal
3.
parser view superview-name superview
4.
secret 5 encrypted-password
5.
view view-name
6.
exit
7.
exit
8.
show parser view [all]
DETAILED STEPS
Monitoring Views and View Users
To display debug messages for all views—root, CLI, lawful intercept, and super, use the debug parser view command in privileged EXEC mode.
Configuration Examples for Role-Based CLI Access
This section contains the following configuration examples:
•
Configuring a CLI View: Example
•
Verifying a CLI View: Example
•
Configuring a Lawful Intercept View: Example
•
Configuring a Superview: Example
Configuring a CLI View: Example
The following example shows how to configure two CLI views, "first" and "second." Thereafter, you can verify the CLI view in the running configuration.
Router(config)# parser view first00:11:40:%PARSER-6-VIEW_CREATED:view 'first' successfully created.Router(config-view)# secret 5 firstpassRouter(config-view)# command exec include show versionRouter(config-view)# command exec include configure terminalRouter(config-view)# command exec include all show ipRouter(config-view)# exitRouter(config)# parser view second00:13:42:%PARSER-6-VIEW_CREATED:view 'second' successfully created.Router(config-view)# secret 5 secondpassRouter(config-view)# command exec include-exclusive show ip interfaceRouter(config-view)# command exec include logoutRouter(config-view)# exit!!Router(config-view)# do show run | beg view
parser view firstsecret 5 $1$MCmh$QuZaU8PIMPlff9sFCZvgW/commands exec include configure terminalcommands exec include configurecommands exec include all show ipcommands exec include show versioncommands exec include show!parser view secondsecret 5 $1$iP2M$R16BXKecMEiQesxLyqygW.commands exec include-exclusive show ip interfacecommands exec include show ipcommands exec include showcommands exec include logout!Verifying a CLI View: Example
After you have configured the CLI views "first" and "second," you can issue the enable view command to verify which commands are available in each view. The following example shows which commands are available inside the CLI view "first" after the user has logged into this view. (Because the show ip command is configured with the all option, a complete set of suboptions is shown, except the show ip interface command, which is using the include-exclusive keyword in the second view.)
Router# enable view firstPassword:00:28:23:%PARSER-6-VIEW_SWITCH:successfully set to view 'first'.Router# ?Exec commands:configure Enter configuration modeenable Turn on privileged commandsexit Exit from the EXECshow Show running system informationRouter# show ?ip IP informationparser Display parser informationversion System hardware and software statusRouter# show ip ?access-lists List IP access listsaccounting The active IP accounting databasealiases IP alias tablearp IP ARP tableas-path-access-list List AS path access listsbgp BGP informationcache IP fast-switching route cachecasa display casa informationcef Cisco Express Forwardingcommunity-list List community-listdfp DFP informationdhcp Show items in the DHCP databasedrp Director response protocoldvmrp DVMRP informationeigrp IP-EIGRP show commandsextcommunity-list List extended-community listflow NetFlow switchinghelper-address helper-address tablehttp HTTP informationigmp IGMP informationirdp ICMP Router Discovery Protocol...Configuring a Lawful Intercept View: Example
The following example shows how to configure a lawful intercept view, add users to the view, and verify the users that were added:
!Initialize the LI-View.Router(config-view)# li-view lipass user li_admin password li_adminpass00:19:25:%PARSER-6-LI_VIEW_INIT:LI-View initialized.Router(config-view)# end! Enter the LI-View; that is, check to see what commands are available within the view.Router# enable view li-viewPassword:Router#00:22:57:%PARSER-6-VIEW_SWITCH:successfully set to view 'li-view'.Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# parser view li-viewRouter(config-view)# ?View commands:commands Configure commands for a viewdefault Set a command to its defaultsexit Exit from view configuration modename New LI-View name ===This option only resides in LI View.no Negate a command or set its defaultspassword Set a password associated with CLI viewsRouter(config-view)#! NOTE:LI View configurations are never shown as part of `running-configuration'.! Configure LI Users.Router(config)# username lawful-intercept li-user1 password li-user1passRouter(config)# username lawful-intercept li-user2 password li-user2pass! Displaying LI User information.Router# show users lawful-interceptli_adminli-user1li-user2Router#Configuring a Superview: Example
The following sample output from the show running-config command shows that "view_one" and "view_two" have been added to superview "su_view1," and "view_three" and "view_four" have been added to superview "su_view2":
!parser view su_view1 superviewsecret 5 <encoded password>view view_oneview view_two!parser view su_view2 superviewsecret 5 <encoded password>view view_threeview view_four!Additional References
The following sections provide references related to Role-Based CLI Access.
Related Documents
Related Topic Document TitleSNMP, MIBs, CLI configuration
Cisco IOS Configuration Fundamentals and Network Management Configuration Guide, Release 12.3
Privilege levels
Cisco IOS Security Configuration Guide, Release 12.3
Standards
MIBs
MIBs MIBs LinkNone
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
Technical Assistance
Command Reference
This section documents only new and modified commands.
New Commands in Cisco IOS Release 12.3(7)T and 12.2(33)SRB
New Commands in Cisco IOS Release 12.3(11)T and 12.2(33)SRB
•
view
New Command in Cisco IOS Release 12.3(14)T
Modified Commands in Cisco IOS Release 12.3(7)T and 12.2(33)SRB
Modified Commands in Cisco IOS Release 12.3(11)T and 12.2(33)SRB
commands (view)
To add commands or an interface to a command-line interface (CLI) view, use the commands command in view configuration mode. To delete a command or an interface from a CLI view, use the no form of this command.
Syntax for Adding and Deleting Commands to a View
commands parser-mode {include | include-exclusive | exclude} [all] [command]
no commands parser-mode {include | include-exclusive | exclude} [all] [command]
Syntax for Adding and Deleting Interfaces to a View
commands parser-mode {include | include-exclusive} [all] [interface interface-name] [command]
no commands parser-mode {include | include-exclusive} [all] [interface interface-name] [command]
Syntax Description
parser-mode
Mode in which the specified command exists. See Table 1 in the "Usage Guidelines" section for a list of available options for this argument.
include
Adds a specified command or a specified interface to the view and allows the same command or interface to be added to an additional view.
include-exclusive
Adds a specified command or a specified interface to the view and excludes the same command or interface from being added to all other views.
exclude
Denies access to commands in the specified parser mode.
Note
This keyword is available only for command-based views.
all
(Optional) A "wildcard" that allows every command in a specified configuration mode that begins with the same keyword or every subinterface within a specified interface to be part of the view.
interface interface-name
(Optional) Interface that is added to the view.
command
(Optional) Command that is added to the view.
Note
If no commands are specified, all commands within the specified parser mode are included or excluded, as appropriate.
Defaults
If this command is not enabled, a view will not have adequate information to deny or allow access to users.
Command Modes
View configuration
Command History
Usage Guidelines
If a network administrator does not enter a specific command (via the command argument) or interface (via the interface interface-name option), users are granted access (via the include or include-exclusive keywords) or denied access (via the exclude keyword) to all commands within the specified parser-mode.
parser-mode Options
Table 1 shows some of the keyword options for the parser-mode argument in the commands command. The available mode keywords vary depending on your hardware and software version. To see a list of available mode options on your system, use the commands ? command.
Examples
The following example shows how to add the privileged EXEC command show version to both CLI views "first" and "second." Because the include keyword was issued, the show version command can be added to both views.
Router(config)# parser view first
Router(config-view)# secret 5 secret
Router(config-view)# commands exec include show version
!Router(config)# parser view second
Router(config-view)# secret 5 myview
Router(config-view)# commands exec include show version
The following example shows how to allow users in the view "first" to execute all commands that start with the word "show" except the show interfaces command, which is excluded by the view "second":
Router(config)# parser view first
Router(config-view)# secret 5 secret
Router(config-view)# commands exec include all show
!Router(config)# parser view second
Router(config-view)# secret 5 myview
Router(config-view)# commands exec include-exclusive show interfaces
Related Commands
Command Descriptionparser view
Creates or changes a CLI view and enters view configuration mode.
secret 5
Associates a CLI view or a superview with a password.
enable
To enter privileged EXEC mode, or any other security level set by a system administrator, use the enable command in user EXEC or privileged EXEC mode.
enable [privilege-level] [view [view-name]]
Syntax Description
Defaults
Privilege-level 15 (privileged EXEC)
Command Modes
User EXEC
Privileged EXEC
Command History
Usage Guidelines
Entering privileged EXEC mode enables the use of privileged commands. Because many of the privileged commands set operating parameters, privileged access should be password-protected to prevent unauthorized use. If the system administrator has set a password with the enable password global configuration command, you are prompted to enter the password before being allowed access to privileged EXEC mode. The password is case sensitive.
If an enable password has not been set, only enable mode can be accessed through the console connection.
Security levels can be set by an administrator using the enable password and privilege level commands. Up to 16 privilege levels can be specified, using the numbers 0 through 15. Using these privilege levels, the administrator can allow or deny access to specific commands. Privilege level 0 is associated with user EXEC mode, and privilege level 15 is associated with privileged EXEC mode.
For more information on defined privilege levels, see the Cisco IOS Security Configuration Guide and the Cisco IOS Security Command Reference publications.
If a level is not specified when entering the enable command, the user will enter the default mode of privileged EXEC (level 15).
Accessing a CLI View
CLI views restrict user access to specified CLI and configuration information. To configure and access CLI views, users must first enter into root view, which is accomplished via the enable view command (without the view-name argument). Thereafter, users are prompted for a password, which is the same password as the privilege level 15 password.
The view-name argument is used to switch from one view to another view.
To prevent dictionary attacks, a user is prompted for a password even if an incorrect view name is given. The user is denied access only after an incorrect view name and password are given.
Examples
In the following example, the user enters privileged EXEC mode using the enable command. The system prompts the user for a password before allowing access to the privileged EXEC mode. The password is not printed to the screen. The user then exits back to user EXEC mode using the disable command. Note that the prompt for user EXEC mode is the greater than symbol (>), and the prompt for privileged EXEC mode is the number sign (#).
Router> enablePassword: <letmein>Router# disableRouter>This following example shows which commands are available inside the CLI view "first" after the user has logged into this view:
Router# enable view firstPassword:00:28:23:%PARSER-6-VIEW_SWITCH:successfully set to view 'first'.Router# ?Exec commands:configure Enter configuration modeenable Turn on privileged commandsexit Exit from the EXECshow Show running system informationRouter# show ?ip IP informationparser Display parser informationversion System hardware and software statusRouter# show ip ?access-lists List IP access listsaccounting The active IP accounting databasealiases IP alias tablearp IP ARP tableas-path-access-list List AS path access listsbgp BGP informationcache IP fast-switching route cachecasa display casa informationcef Cisco Express Forwardingcommunity-list List community-listdfp DFP informationdhcp Show items in the DHCP databasedrp Director response protocoldvmrp DVMRP informationeigrp IP-EIGRP show commandsextcommunity-list List extended-community listflow NetFlow switchinghelper-address helper-address tablehttp HTTP informationigmp IGMP informationirdp ICMP Router Discovery Protocol...The following command shows how to issue the enable view command to switch from the root view to the CLI view "first":
Router# enable viewRouter#01:08:16:%PARSER-6-VIEW_SWITCH:successfully set to view 'root'.Router#! Enable the show parser view command from the root viewRouter# show parser viewCurrent view is 'root'! Enable the show parser view command from the root view to display all viewsRouter# show parser view allViews Present in System:View Name: firstView Name: second! Switch to the CLI view "first."Router# enable view firstRouter#01:08:09:%PARSER-6-VIEW_SWITCH:successfully set to view 'first'.! Enable the show parser view command from the CLI view "first."Router# show parser viewCurrent view is 'first'Related Commands
li-view
To initialize a lawful intercept view, use the li-view command in global configuration mode.
li-view li-password user username password password
Syntax Description
Defaults
A lawful intercept view cannot be accessed.
Command Modes
Global configuration
Command History
Release Modification12.3(7)T
This command was introduced.
12.2(33)SRB
This command was integrated into Cisco IOS Release 12.2(33)SRB.
Usage Guidelines
Like a command-line interface (CLI) view, a lawful intercept view restricts access to specified commands and configuration information. Specifically, a lawful intercept view allows a user to secure access to lawful intercept commands that are held within the TAP-MIB, which is a special set of simple network management protocol (SNMP) commands that stores information about calls and users.
Commands available in lawful intercept view belong to one of the following categories:
•
Lawful intercept commands that should not be made available to any other view or privilege level.
•
CLI that are useful for lawful intercept users but do not need to be excluded from other views or privilege levels.
Note
Only a system administrator or a level 15 privilege user can initialize a lawful intercept view.
Examples
The following example shows how to configure a lawful intercept view, add users to the view, and verify the users that were added to the view:
!Initialize the LI-View.Router(config-view)# li-view lipass user li_admin password li_adminpass00:19:25:%PARSER-6-LI_VIEW_INIT:LI-View initialized.Router(config-view)# end! Enter the LI-View; that is, check to see what commands are available within the view.Router# enable view li-viewPassword:Router#00:22:57:%PARSER-6-VIEW_SWITCH:successfully set to view 'li-view'.Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# parser view li-viewRouter(config-view)# ?View commands:commands Configure commands for a viewdefault Set a command to its defaultsexit Exit from view configuration modename New LI-View name ===This option only resides in LI View.no Negate a command or set its defaultspassword Set a password associated with CLI viewsRouter(config-view)#! NOTE:LI View configurations are never shown as part of `running-configuration'.! Configure LI Users.Router(config)# username lawful-intercept li-user1 password li-user1passRouter(config)# username lawful-intercept li-user2 password li-user2pass! Displaying LI User information.Router# show users lawful-interceptli_adminli-user1li-user2Router#Related Commands
Command Descriptionshow users
Displays information about the active lines on the router.
username
Establishes a username-based authentication system.
name (view)
To change the name of a lawful intercept view, use the name command in view configuration mode. To return to the default lawful intercept view name, which is "li-view," use the no form of this command.
name new-name
no name new-name
Syntax Description
Defaults
A lawful intercept view is called "li-view."
Command Modes
View configuration
Command History
Release Modification12.3(7)T
This command was introduced.
12.2(33)SRB
This command was integrated into Cisco IOS Release 12.2(33)SRB.
Usage Guidelines
Only a system administrator or a level 15 privilege user can change the name of a lawful intercept view.
Examples
The following example shows how to configure a lawful intercept view and change the view name to "myliview":
!Initialize the LI-View.Router(config-view)# li-view lipass user li_admin password li_adminpass00:19:25:%PARSER-6-LI_VIEW_INIT:LI-View initialized.Router(config-view)# name myliviewRouter(config-view)# endRelated Commands
Command Descriptionli-view
Creates a lawful intercept view.
parser view
Creates or changes a CLI view and enters view configuration mode.
parser view
To create or change a command-line interface (CLI) view and enter view configuration mode, use the parser view command in global configuration mode. To delete a view, use the no form of this command.
parser view view-name
no parser view view-name
Syntax Description
Defaults
A CLI view does not exist.
Command Modes
Global configuration
Command History
Release Modification12.3(7)T
This command was introduced.
12.2(33)SRB
This command was integrated into Cisco IOS Release 12.2(33)SRB.
Usage Guidelines
A CLI view is a set of operational commands and configuration capabilities that restrict user access to the CLI and configuration information; that is, a view allows users to define what commands are accepted and what configuration information is visible.
After you have issued the parser view command, you can configure the view via the secret 5 command and the commands command.
To use the parser view command, the system of the user must be set to root view. The root view can be enabled via the enable view command.
Examples
The following example show how to configure two CLI views, "first" and "second."
Router(config)# parser view first00:11:40:%PARSER-6-VIEW_CREATED:view 'first' successfully created.Router(config-view)# secret 5 firstpassRouter(config-view)# command exec include show versionRouter(config-view)# command exec include configure terminalRouter(config-view)# command exec include all show ipRouter(config-view)# exitRouter(config)# parser view second00:13:42:%PARSER-6-VIEW_CREATED:view 'second' successfully created.Router(config-view)# secret 5 secondpassRouter(config-view)# command exec include-exclusive show ip interfaceRouter(config-view)# command exec include logoutRouter(config-view)# exitAfter you have successfully created a view, a system message such as the following will be displayed:
%PARSER-6-VIEW_CREATED: view `first' successfully created.After you have successfully deleted a view, a system message such as the following will be displayed:
%PARSER-6-VIEW_DELETED: view `first' successfully deleted.Related Commands
Command Descriptioncommands (view)
Adds commands to a CLI view.
secret 5
Associates a CLI view or a superview with a password.
parser view superview
To create a superview and enter view configuration mode, use the parser view superview command in global configuration mode. To delete a superview, use the no form of this command.
parser view superview-name superview
no parser view superview-name superview
Syntax Description
superview-name
Superview name, which can include 1 to 30 alphanumeric characters.
The superview-name argument must not have a number as the first character.
Defaults
A superview does not exist.
Command Modes
Global configuration
Command History
Release Modification12.3(11)T
This command was introduced.
12.2(33)SRB
This command was integrated into Cisco IOS Release 12.2(33)SRB.
Usage Guidelines
A superview consists of one or more command-line interface (CLI) views, which allow users to define what commands are accepted and what configuration information is visible. Superviews allow a network administrator to easily assign all users within configured CLI views to a superview instead of having to assign multiple CLI views to a group of users.
Superviews contain the following characteristics:
•
A CLI view can be shared among multiple superviews.
•
Commands cannot be configured for a superview; that is, you must add commands to the CLI view and add that CLI view to the superview.
•
Users who are logged into a superview can access all of the commands that are configured for any of the CLI views that are part of the superview.
•
Each superview has a password that is used to switch between superviews or from a CLI view to a superview.
Adding CLI Views to a Superview
You can add a view to a superview only after a password has been configured for the superview (via the secret 5 command). Thereafter, issue the view command in view configuration mode to add at least one CLI view to the superview.
Note
Before adding a CLI view to a superview, ensure that the CLI views that are added to the superview are valid views in the system; that is, the views have been successfully created via the parser view command.
Examples
The following sample output from the show running-config command shows that "view_one" and "view_two" have been added to superview "su_view1," and "view_three" and "view_four" have been added to superview "su_view2":
!parser view su_view1 superviewsecret 5 <encoded password>view view_oneview view_two!parser view su_view2 superviewsecret 5 <encoded password>view view_threeview view_four!Related Commands
secret
To associate a command-line interface (CLI) view or a superview with a password, use the secret command in view configuration mode.
secret {unencrypted-password | 0 unencrypted-password | 5 encrypted-password}
Syntax Description
Defaults
User cannot access a CLI view or superview.
Command Modes
View configuration
Command History
Usage Guidelines
A user cannot access any commands within the CLI view or superview until the secret command has been issued.
Note
The password cannot be removed, but you can overwrite it.
Examples
The following examples show how to configure two CLI views, "first" and "second," and associate each view with a password:
CLI View "first"
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# parser view firstRouter(config-view)#*Dec 9 05:20:03.039: %PARSER-6-VIEW_CREATED: view 'first' successfully created.Router(config-view)# secret firstpasswordRouter(config-view)# secret secondpassword% Overwriting existing secret for the current viewRouter(config-view)# secret 0 thirdpassword% Overwriting existing secret for the current viewRouter(config-view)# secret 5 $1$jj1e$vmYyRbmj5UoU96tT1x7eP1% Overwriting existing secret for the current viewRouter(config-view)# secret 5 invalidpasswordERROR: The secret you entered is not a valid encrypted secret.To enter an UNENCRYPTED secret, do not specify type 5 encryption.When you properly enter an UNENCRYPTED secret, it will be encrypted.Router(config-view)# command exec include show versionRouter(config-view)# command exec include configure terminalRouter(config-view)# command configure include all ipRouter(config-view)# exitCLI View "second"
Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# parser view secondRouter(config-view)#*Dec 30 06:11:52.915: %PARSER-6-VIEW_CREATED: view 'second' successfully created.Router(config-view)# secret mypasswdRouter(config-view)# commands exec include pingRouter(config-view)# endRouter# show running-configparser view secondsecret 5 $1$PWs8$lz3lSx6OqAnFrUx2hkI0w0commands exec include ping!The following is an example of show running-config output for a situation in which the secret command has been configured using a level 5 encrypted password:Router: show running-configparser view firstsecret 5 $1$jj1e$vmYyRbmj5UoU96tT1x7eP1commands configure include all ipcommands exec include configure terminalcommands exec include configurecommands exec include show versioncommands exec include show!Related Commands
show parser view
To display command-line interface (CLI) view information, use the show parser view command in privileged EXEC mode.
show parser view [all]
Syntax Description
Command Modes
Privileged EXEC
Command History
Release Modification12.3(7)T
This command was introduced.
12.2(33)SRB
This command was integrated into Cisco IOS Release 12.2(33)SRB.
Usage Guidelines
The show parser view command will display information only about the view that the user is currently in. This command is available for both root view users and lawful intercept view users—except for the all keyword, which is available only to root view users. However, the all keyword can be configured by a user in root view to be available for users in lawful intercept view.
The show parser view command cannot be excluded from any view.
Examples
The following example shows how to display information from the root view and the CLI view "first":
Router# enable viewRouter#01:08:16:%PARSER-6-VIEW_SWITCH:successfully set to view 'root'.Router#! Enable the show parser view command from the root viewRouter# show parser viewCurrent view is 'root'! Enable the show parser view command from the root view to display all viewsRouter# show parser view allViews Present in System:View Name: firstView Name: second! Switch to the CLI view "first."Router# enable view firstRouter#01:08:09:%PARSER-6-VIEW_SWITCH:successfully set to view 'first'.! Enable the show parser view command from the CLI view "first."Router# show parser viewCurrent view is 'first'Related Commands
show users
To display information about the active lines on the router, use the show users command in privileged EXEC mode.
show users [all] [lawful-intercept]
Syntax Description
all
(Optional) Specifies that all lines be displayed, regardless of whether anyone is using them.
lawful-intercept
(Optional) Displays lawful-intercept users.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
This command displays the line number, connection name, idle time, hosts (including virtual access interfaces), and terminal location. An asterisk (*) indicates the current terminal session.
If the lawful-intercept keyword is issued, the names of all users who have access to a configured lawful intercept view will be displayed. To access the show users lawful-intercept command, you must be an authorized lawful-intercept-view user.
Examples
The following is sample output from the show users command:
Router# show usersLine User Host(s) Idle Location0 con 0 idle* 2 vty 0 user1 idle 0 SERVICE1.CISCO.COMThe following is sample output identifying an active virtual access interface:
Router# show usersLine User Host(s) Idle Location* 0 con 0 idle 01:5810 vty 0 Virtual-Access2 0 1212321The following is sample output from the show users all command:
Router# show users allLine User Host(s) Idle Location* 0 vty 0 user1 idle 0 SERVICE1.CISCO.COM1 vty 12 con 03 aux 04 vty 2Table 2 describes the significant fields shown in the displays.
The following sample output from the show users lawful intercept command, shows three LI-View users on the system—li_admin, li-user1, and li-user2":
Router# show users lawful-interceptli_adminli-user1li-user2Router#Related Commands
username
To establish a username-based authentication system, use the username command in global configuration mode. Use the no form of this command to remove an established username-based authentication.
username name {nopassword | password password | password encryption-type encrypted-password}
username name password secret
username name [access-class number]
username name [autocommand command]
username name [callback-dialstring telephone-number]
username name [callback-rotary rotary-group-number]
username name [callback-line [tty] line-number [ending-line-number]]
username name dnis
username name [nocallback-verify]
username name [noescape] [nohangup]
username name [privilege level]
username name user-maxlinks number
username [lawful-intercept] name [privilege privilege-level | view view-name] password password
no username name
Syntax Description
Defaults
No username-based authentication system is established.
Command Modes
Global configuration
Command History
Usage Guidelines
The username command provides username or password authentication, or both, for login purposes only.
Multiple username commands can be used to specify options for a single user.
Add a username entry for each remote system with which the local router communicates and from which it requires authentication. The remote device must have a username entry for the local router. This entry must have the same password as the local router's entry for that remote device.
This command can be useful for defining usernames that get special treatment. For example, you can use this command to define an "info" username that does not require a password but connects the user to a general purpose information service.
The username command is required as part of the configuration for the Challenge Handshake Authentication Protocol (CHAP). Add a username entry for each remote system from which the local router requires authentication.
Note
To enable the local router to respond to remote CHAP challenges, one username name entry must be the same as the hostname entry that has already been assigned to the other router.
Note
To avoid the situation of a privilege level 1 user entering into a higher privilege level, configure a per-user privilege level other than 1 (for example, 0 or 2 through 15).
Note
Per-user privilege levels override virtual terminal (VTY) privilege levels.
CLI and Lawful Intercept Views
Both CLI views and lawful intercept views restrict access to specified commands and configuration information. A lawful intercept view allows a user to secure access to lawful intercept commands that are held within the TAP-MIB, which is a special set of simple network management protocol (SNMP) commands that stores information about calls and users.
Users who are specified via the lawful-intercept keyword are placed in the lawful-intercept view, by default, if no other privilege level or view name has been explicitly specified.
If there is no secret specified and the debug serial-interface command is enabled, an error is displayed when a link is established and the CHAP challenge is not implemented. CHAP debugging information is available using the debug ppp negotiation, debug serial-interface, and debug serial-packet commands. For more information about debug commands, refer to the Cisco IOS Debug
Command Reference.Examples
The following example implements a service similar to the UNIX who command, which can be entered at the login prompt and lists the current users of the router:
username who nopassword nohangup autocommand show usersThe following example implements an information service that does not require a password to be used. The command takes the following form:
username info nopassword noescape autocommand telnet nic.ddn.milThe following example implements an ID that works even if all the TACACS+ servers break. The command takes the following form:
username superuser password superpasswordThe following example enables CHAP on interface serial 0 of "server_l." It also defines a password for a remote server named "server_r."
hostname server_l username server_r password theirsystem interface serial 0 encapsulation ppp ppp authentication chapWhen you look at your configuration file, the passwords will be encrypted, and the display will look similar to the following:
hostname server_l username server_r password 7 121F0A18 interface serial 0 encapsulation ppp ppp authentication chapIn both of the following configuration examples, a privilege level 1 user is denied access to privilege levels higher than 1:
username user privilege 0 password 0 ciscousername user 2 privilege 2 password 0 ciscoThe following example removes the username-based authentication for user 2:
no username user 2Related Commands
view
To add a normal command-line interface (CLI) view to a superview, use the view command in view configuration mode. To remove a CLI view from a superview, use the no form of this command.
view view-name
no view view-name
Syntax Description
Defaults
A superview will not contain any CLI views until this command is enabled.
Command Modes
View configuration
Command History
Release Modification12.3(11)T
This command was introduced.
12.2(33)SRB
This command was integrated into Cisco IOS Release 12.2(33)SRB.
Usage Guidelines
Before you can use this command to add normal views to a superview, ensure that the following steps have been taken:
•
A password has been configured for the superview (via the secret 5 command).
•
The normal views that are to be added to the superview are valid views in the system; that is, the views have been successfully created via the parser view command.
Examples
The following sample output from the show running-config command shows that "view_one" and "view_two" have been added to superview "su_view1," and "view_three" and "view_four" have been added to superview "su_view2":
!parser view su_view1 superviewsecret 5 <encoded password>view view_oneview view_two!parser view su_view2 superviewsecret 5 <encoded password>view view_threeview view_four!Related Commands
Command Descriptionparser view
Creates or changes a CLI view and enters view configuration mode.
secret 5
Associates a CLI view or a superview with a password.
Copyright © 2007 Cisco Systems, Inc. All rights reserved.