Cisco Systems: Cisco ASA privilege configuration

The default privilege 15 is a superuser account, however you can change the default behaviour. In this example I will create a username that has privilege 4 access.

ciscoasa(config)# username adminreader password 121278 privilege 4
ciscoasa(config)# privilege show level 4 command running-config
ciscoasa(config)# privilege show level 4 command access-list
ciscoasa(config)# privilege show level 4 command conn

Then I will need to use aaa commands to tell where to locate the privilege.

aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa authentication enable console LOCAL
aaa authorization command LOCAL
aaa local authentication attempts max-fail 5

When a user attempts to ssh, the cisco asa will check the local database for the authentication information.
When a user attempts to login to asdm the cisco asa will check the local database for the authentication information.
When a user attempts to go to privilege exec mode, the cisco asa will check the local database for the authentication information.
After authenticated the cisco asa will check the local database to find out what commands can be executed by the authenticated user.
The maximum fail login rate is 5 times, if this is exceeded the user will be locked.
Here’s the command to unlock user account.
clear aaa local user all clears all username locked status.
clear aaa local user username adminreader clears username adminreader’s locked status.