Norman Zhang wrote:
I have the following setup for users
DEFAULT Auth-Type = System Fall-Through = Yes, cisco-avpair = "shell:priv-lvl=1", Service-Type = NAS-Prompt-User
DEFAULT Group == router-ro cisco-avpair := "shell:priv-lvl=7"
DEFAULT Group == router-rw cisco-avpair := "shell:priv-lvl=15"
However, system users not in group router-ro or router-rw are still able to login with privilege level = 1.
Because you configured the server to permit that. Please read "man users" to see how the "users" file works.
Is there a way to force only group router-ro and router-rw can login?
Switch the entries around: DEFAULT Group == router-ro Fall-Through = Yes, cisco-avpair := "shell:priv-lvl=7" DEFAULT Group == router-rw Fall-Through = Yes, cisco-avpair := "shell:priv-lvl=15" DEFAULT Auth-Type = System Service-Type = NAS-Prompt-User And do NOT just blindly try it and see if it works. Spend some time understanding it first. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog