Need to grant Read-Only access to configurations but none to devices

[jj752]

I need to grant access to our router and switch configurations to an IT Auditor in our company. However, the current roles limit my choices to either Network Operator or Network Admin. Obviously, these two roles are far too powerful to grant to our auditor since he would also have the ability to mess with our devices. Is there a way to grant him the access to the configurations WITHOUT giving him access to our devices?

 

[thethmon]

We have looked for a similar functionality in the past; however, unfortunately we have never found a way to do this. We have requested increased functionality from Cisco, but to date, they have not committed to increasing the flexibility with the roles and responsibilities. If you find something, I would love to hear about it.

Todd Hethmon
thethmon@hethmon.com

 

[dx1]

Have you thought about using Cisco ACS for AAA? You can have the auditor login and authenticate to a tacacs server and only allow them to run commands that you specify.

 

[rboddy]

There is a software application, I have seen that should give the flexibility, you require.

http://www.renditionnetworks.com

The other method would be to copy the configs from the archive/shadow subdirectories to where they can be accessed by the auditor.