Disable Display Current-Configuration.

[acapper]

Good morning, I need to create a read-only user who also can't run the display current-configuration command
How can I do it?
Thank you.

[akg7 · Accepted solution]

Hello,

How users are authenitcated, local or via ladius?

You have to set user privilege level 0.

Please refer below link for your reference:

https://support.hpe.com/hpesc/public/docDisplay?docId=c03538018&docLocale=en_US

Thanks!

[acapper]

Thank you for the answer akg7

I created a local user
If I add the level-0 role, the current-configuration display does not work, but neither does the rest of the displays.
I want it to work all display commands except current-configuration and save-configuration.

[HP_5510_Cores]display ?
Permission denied.

[HP_5510_Cores]command-privilege
^
% Unrecognized command found at '^' position.

command-privilege does not recognize me as a valid command.

[acapper]

I created the user Peter, and I assign him the user-role level-1

local-user Peter class manage
service-type ssh
authorization-attribute user-role level-1

Then in the role name level-1 I add the following lines to deny the display current and save commands

role name level-1
description Predefined level-1 role
rule 1 deny command display current-configuration
rule 2 deny command display save-configuration

I enter with the user Peter, I run the display current-configuration command and it allows me.

I don't understand anything.

[acapper]

It already works for me, with the settings of the previous post.

It must be that I did not save changes or had not logout with user Peter and then login again.

Thank you very much for the help.
Greetings