Re: [c-nsp] Setting up a RO user in IOS-XR and IOS-XE

--===============2971723436379718112==
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="nnPYZjQUKi1a5Npm"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit


--nnPYZjQUKi1a5Npm
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi,

On Mon, Feb 16, 2026 at 05:40:21PM +0200, Hank Nussbacher via cisco-nsp wro=
te:
> Under IOS-XE if we do:
>=20
> username <username> privilege 1 secret <password>
>=20
> the user has no ability to do any show commands.

Unless there is "something in the config" that puts "show" to priv level 15,
this is exactly how you do it...

ar3.sv3-2>sh priv
Current privilege level is 1
ar3.sv3-2>sh ver
Cisco IOS XE Software, Version 17.09.05a
=2E..
ar3.sv3-2>sh ip int brief
Interface              IP-Address      OK? Method Status                Pro=
tocol
Te0/0/0                unassigned      YES NVRAM  up                    up =
    =20


(in this case, the priv=3D1 comes from TACACS, but "show priv" is=20
authoritative enough)

[..]
> but "task read" requires many additional parameters such as ???task read
> ospf???, ???task read acl???, ???task read bgp???, ???task read ipv4??? ,
> etc.
>=20
> Can anyone provide the exact IOS-XE and IOS-XR commands to create a RO us=
er?

IOS XR does not have "a RO user", and no simple 1..15 privilege leveling
- you need to define fairly explicitly on which subsystems a use can have
"show" privs.

One of our boxes has, for example

taskgroup basic-admin
 task read bgp
 task read cdp
 task read cef
 task read rib
 task read ipv4
 task read ipv6
 task read l2vpn
 task read network
 task read interface
 task read ethernet-services
!
usergroup priv1
 taskgroup basic-admin

=2E.. because that is what the scripts that go there to look for info
need.

Another "RO user" could have read access on other things...

gert
--=20
"If was one thing all people took for granted, was conviction that if you=
=20
 feed honest figures into a computer, honest figures come out. Never doubte=
d=20
 it myself till I met a computer with a sense of humor."
                             Robert A. Heinlein, The Moon is a Harsh Mistre=
ss

Gert Doering - Munich, Germany                             [email protected]=
=2Ede

--nnPYZjQUKi1a5Npm
Content-Type: application/pgp-signature; name=signature.asc
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----

iQGzBAEBCAAdFiEEti5qK05WVwt73GvgHYKe/spWKBIFAmmTPfYACgkQHYKe/spW
KBL1SQv7BoeKvsF6FiUaC5ygluvIBBHZ8KSFbBAH25j60FQRd5B2wdhM03td3+Ml
D3mJm/uTFs4zm56qu67rFyGUtOb2go7wUWTZyTqxN6ADKZhfx7GTEYsP5G7GPYCQ
DQPvLORWkZcLljTbeiDzfuVCX3J2nVxqMEa3PvtfdPWo4Zs+9tyJdulejm+ZaAc9
ug+5pXBpbvw9Bt0PfLUDDEz33J98Ux7N0rrg3g9RGRN9GEmEkyoY7qKGoh7Q5VVT
ut7M+1JafC5cQG2kHeaaSTo134LtJzYhiy76JL6LnFSAXeVKYJQR8ORfcbp1A1Fd
RC+Q9qVx9d1RoCY5lNGKm0jFzAuWPkapKeoL+aF1DfAvwFGCo7TmmReUZx5TOWVC
v9aW9srMVHw4RtitljgDcayEbM7uUVS1j/Ey2DqMZf3+3yrRMO8L/YqoEOw6ty9K
Mty8WEVGjwdB2I5tAuoY/SAzcQnRtgMwWBHlbe6ymoiv8CGMvdHLa72mdaLKizFq
hMx5oCrs
=Md/6
-----END PGP SIGNATURE-----

--nnPYZjQUKi1a5Npm--

--===============2971723436379718112==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KY2lzY28tbnNw
IG1haWxpbmcgbGlzdCAgY2lzY28tbnNwQHB1Y2submV0aGVyLm5ldApodHRwczovL3B1Y2submV0
aGVyLm5ldC9tYWlsbWFuL2xpc3RpbmZvL2Npc2NvLW5zcAphcmNoaXZlIGF0IGh0dHA6Ly9wdWNr
Lm5ldGhlci5uZXQvcGlwZXJtYWlsL2Npc2NvLW5zcC8K

--===============2971723436379718112==--