username privilege
Create role-based access accounts on network devices, assigning different privilege levels for different administrative roles.
Definition: username privilege is a Cisco IOS global config command. Creates a local user account with a specific privilege level (0-15) and a hashed password stored in the configuration. Privilege 15 grants full access equivalent to enable mode.
Overview
The `username [name] privilege [1-15]` command in Cisco IOS is used to assign a privilege level to a local user account, controlling which commands that user can execute. Privilege levels range from 1 (lowest) to 15 (highest, equivalent to privileged EXEC mode). This command is essential for implementing role-based access control (RBAC) on network devices, allowing administrators to grant limited access to junior staff or external contractors without exposing critical configuration commands.
The concept behind privilege levels is hierarchical: each level inherits commands from lower levels, and you can customize command authorization per level using `privilege exec level <level> <command>`. You would use this command when you need to create local user accounts with specific access rights, especially in environments without a centralized AAA server (like RADIUS or TACACS+). Alternatives include using AAA with TACACS+ for granular command authorization, but the local username command is simpler for small networks or backup access.
In the broader workflow, after creating the user, you must also configure `enable secret` for privilege escalation and optionally `aaa new-model` to enable AAA. Important IOS behavior: the privilege level set here applies to the user's initial login; if the user needs to access higher-level commands, they must use the `enable` command (if they know the enable secret). The running config stores the username and privilege level in plaintext (unless using `username secret` for password hashing).
This command is fundamental for security and compliance, ensuring that users only have the minimum necessary access.
username <name> privilege <0-15> secret <password>When to Use This Command
- Create an admin account with privilege 15 for full device access
- Create a read-only account with privilege 1 for NOC staff who only need show commands
- Required for SSH when using login local on vty lines
- Set up accounts for AAA fallback when RADIUS/TACACS+ is unreachable
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| name | WORD | The username for the local user account. It can be alphanumeric and case-sensitive. Common mistakes include using spaces or special characters that are not allowed; avoid names that conflict with reserved keywords like 'enable' or 'admin'. |
| privilege | <1-15> | The privilege level assigned to the user. Level 1 is user EXEC mode (limited show commands), level 15 is privileged EXEC (full access). Levels 2-14 are custom and require additional configuration to define which commands are available. Common mistake: assigning level 15 without proper password protection, or using level 1 when the user needs to configure interfaces. |
Command Examples
Create admin and read-only accounts
Router(config)# username admin privilege 15 secret $tr0ngP@ss! Router(config)# username readonly privilege 1 secret ReadOnlyP@ss! Router(config)# line vty 0 15 Router(config-line)# login local Router(config-line)# transport input ssh Router(config-line)# end
Understanding the Output
privilege 15 = EXEC mode (full access, equivalent to enable). privilege 1 = user EXEC (limited show commands only). privilege 0 = no commands. Accounts with privilege < 15 see only the > prompt and cannot access # prompt without enable. secret uses Type 9 (SHA-256) or Type 5 (MD5) hashing — always use secret not password for hashed storage.
Configuration Scenarios
Create a read-only user for monitoring
A network administrator wants to give a junior engineer read-only access to monitor device status without allowing configuration changes. The user should only be able to execute basic show commands.
Topology
Single router R1Steps
- 1.Step 1: Enter global configuration mode: R1> enable
- 2.Step 2: Enter global config: R1# configure terminal
- 3.Step 3: Create user with privilege level 1: R1(config)# username monitor privilege 1 secret cisco123
- 4.Step 4: (Optional) Enable AAA login authentication: R1(config)# aaa new-model
- 5.Step 5: (Optional) Apply local authentication for console and VTY: R1(config)# line console 0, R1(config-line)# login local, R1(config-line)# line vty 0 4, R1(config-line)# login local
- 6.Step 6: Exit and save: R1(config)# end, R1# write memory
! Full IOS config block R1(config)# username monitor privilege 1 secret cisco123 R1(config)# aaa new-model R1(config)# line console 0 R1(config-line)# login local R1(config-line)# line vty 0 4 R1(config-line)# login local
Verify: Command: show running-config | include username Expected output: username monitor privilege 1 secret 5 $1$... (encrypted) Also test by logging in as 'monitor' and attempting 'configure terminal' – should be denied.
Watch out: If AAA new-model is not enabled, the 'login local' command on lines may not work; also, the user's password is stored as type 7 (weak) unless 'secret' keyword is used.
Create a privileged user for network operations
A senior network engineer needs full access to configure and troubleshoot a router. The user should have privilege level 15, equivalent to the enable mode.
Topology
Single router R1Steps
- 1.Step 1: Enter privileged EXEC mode: R1> enable
- 2.Step 2: Enter global config: R1# configure terminal
- 3.Step 3: Create user with privilege level 15: R1(config)# username netadmin privilege 15 secret Str0ngP@ss
- 4.Step 4: Enable local authentication: R1(config)# aaa new-model
- 5.Step 5: Apply login local to console and VTY: R1(config)# line console 0, R1(config-line)# login local, R1(config-line)# line vty 0 4, R1(config-line)# login local
- 6.Step 6: Exit and save: R1(config)# end, R1# write memory
! Full IOS config block R1(config)# username netadmin privilege 15 secret Str0ngP@ss R1(config)# aaa new-model R1(config)# line console 0 R1(config-line)# login local R1(config-line)# line vty 0 4 R1(config-line)# login local
Verify: Command: show running-config | include username Expected output: username netadmin privilege 15 secret 5 $1$... Also test by logging in as 'netadmin' – should be in privileged EXEC mode immediately (no need for 'enable').
Watch out: If the user is assigned privilege 15, they bypass the 'enable' password prompt; ensure the 'enable secret' is also set for other access methods.
Troubleshooting with This Command
When troubleshooting issues with the `username [name] privilege [1-15]` command, focus on verifying that the user can log in and has the expected command access. Healthy output from `show running-config | include username` shows the username, privilege level, and an encrypted password (type 5 or 8/9). Problem indicators include: the user cannot log in (authentication failure), the user can log in but cannot execute expected commands (authorization failure), or the user has too much access.
Common symptoms: 'Authentication failed' messages during login often indicate a mismatch between the configured password and the one entered, or that the user account does not exist. Use `debug aaa authentication` to see the authentication process. If the user logs in but cannot run certain commands, check the privilege level: a user with privilege 1 cannot enter global config mode.
Use `show privilege` while logged in as the user to see current level. To diagnose authorization, use `debug aaa authorization` or `show aaa user` (if AAA is enabled). Another common issue is that the 'login local' command is not applied to the appropriate lines (console, VTY, AUX).
Verify with `show running-config | section line`. Also, if AAA new-model is not enabled, 'login local' may not work; ensure `aaa new-model` is present. If the user has privilege 15 but still cannot access certain commands, check if command authorization is configured via AAA (e.g., `aaa authorization commands 15 local`).
Correlate with `show running-config | section aaa` to see AAA configuration. For password issues, note that the 'secret' keyword stores a hashed password (MD5), while 'password' stores type 7 (weak); always use 'secret' for security. If the user is locked out, use the console with physical access to recover.
Finally, remember that privilege levels are cumulative: a user with level 5 can execute all commands assigned to levels 1-5. Use `show privilege` to see the current level and `?` to list available commands.
CCNA Exam Tips
CCNA exam: always use username <name> privilege 15 secret <pw> not username <name> privilege 15 password <pw> — 'secret' stores a hash, 'password' stores with weak Type 7 encryption or plaintext
Privilege levels 0, 1, and 15 are predefined
Levels 2-14 are custom and require assigning specific commands with privilege exec level commands
Common Mistakes
Using password instead of secret — stores a reversible Type 7 hash
Creating accounts but forgetting login local on vty lines — device still uses only the line password
Privilege 15 users bypass enable password/secret — they enter EXEC directly after login
Forgetting to set a password at all (privilege without secret creates an account with no password)
username privilege vs crypto key generate rsa
Both 'username privilege' and 'crypto key generate rsa' are essential for enabling secure SSH access on Cisco IOS devices. The former manages user authentication and authorization, while the latter provides encryption keys. They are often considered together because both are required steps in a typical SSH configuration.
| Aspect | username privilege | crypto key generate rsa |
|---|---|---|
| Purpose | Create local user account with privilege level (0-15) and hashed password | Generate RSA key pair for SSH encryption |
| Configuration Mode | Global configuration | Global configuration |
| Persistence | Stored in running-config; survives reload if configuration saved | Keys stored in NVRAM (private config); survive reload if saved |
| Precedence | Used for local authentication; overridden by AAA (TACACS+/RADIUS) if configured | Must be generated before enabling SSH server; no precedence with other auth methods |
| Typical Use | Define user accounts with specific CLI access levels | Enable SSH server on the device for secure remote management |
Use username privilege when you need to create local user accounts with controlled privilege levels for CLI access, especially for non-AAA environments.
Platform Notes
In IOS-XE (e.g., Catalyst 9000 switches), the syntax is identical: `username [name] privilege [1-15] secret [password]`. However, IOS-XE supports additional hashing algorithms like type 8 (PBKDF2) and type 9 (scrypt) for stronger password storage; use `username [name] privilege [1-15] secret 9 [password]` for scrypt. In NX-OS (Cisco Nexus switches), the equivalent command is `username [name] role [role-name]` where roles are predefined (e.g., network-admin, network-operator).
NX-OS does not use privilege levels; instead, it uses role-based access control (RBAC). To achieve similar granularity, you can create custom roles with `role name [role-name]` and assign commands. For ASA (Adaptive Security Appliance), the command is `username [name] password [password] privilege [0-15]` where privilege 15 is full access.
ASA also uses privilege levels but with different default command sets. In IOS-XR (Cisco 9000 series routers), the command is `username [name] secret [password]` and then you assign a task group or user group for authorization; privilege levels are not used. Instead, use `username [name] group [group-name]` and define permissions via task groups.
For older IOS versions (12.x), the 'secret' keyword may not be available; use 'password' but it stores type 7. In 15.x and later, 'secret' is recommended. Always check the specific platform documentation for exact syntax and capabilities.
Related Commands
crypto key generate rsa
Generates RSA key pairs used to enable SSH on Cisco IOS devices. The modulus size determines key strength — minimum 768 bits for SSH version 1, 1024 bits recommended for SSH version 2.
login on-failure
Enables syslog logging of failed login attempts, recording the username attempted, source IP address, and timestamp. Used for security monitoring and brute-force detection.
service password-encryption
Enables Cisco Type 7 (Vigenère cipher) encryption for all plaintext passwords stored in the running configuration, including line passwords, CHAP passwords, and username passwords not already using stronger hashing.
show aaa servers
Displays statistics for all AAA servers (RADIUS and TACACS+) configured on the device including server status, request/response counts, authentication success and failure rates, and round-trip times.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions