Default Authentication

[Norman Zhang]

I have the following setup for users

DEFAULT	Auth-Type = System
	Fall-Through = Yes,
	cisco-avpair = "shell:priv-lvl=1",
	Service-Type = NAS-Prompt-User

DEFAULT Group == router-ro
	cisco-avpair := "shell:priv-lvl=7"

DEFAULT Group == router-rw
	cisco-avpair := "shell:priv-lvl=15"

However, system users not in group router-ro or router-rw are still able 
to login with privilege level = 1. Is there a way to force only group 
router-ro and router-rw can login?

Norman