topic The Need for Enable Password in Network Access Control

The Need for Enable Password

Patrick McHenry — Mon, 11 Mar 2019 02:48:11 GMT

Hi,

If all users that have acces to the network equipment will be given level 15, is there any reason to have an enable password?

Just seems like another step to authenticate - and if we are using the same passowrd for enable that we are for the login, I don't see the point.

Thanks, Pat.

The Need for Enable Password

mauzamor — Mon, 19 Nov 2012 14:40:26 GMT

Hi Patrick,

The enable password in this scenario may work as a fallback method, but is up to you to decide this. In case that you want to skip the enable password prompt you can use the command:

aaa authorization exec default group tacacs+ local

This command will check the privilege level of each user and will put him into privilege mode right after the credentials have been checked.

This feature only works for IOS devices (the ASA or PIX doesn't have this feature)

Let me know if it helps.

The Need for Enable Password

Patrick McHenry — Mon, 19 Nov 2012 14:56:03 GMT

Thanks Mauicio,

This is the config. We are trying to authenticate via tacacs that is configured to query AD. And, it is working great. I just want to make it so we can go directly into priv mode after logging in with username and password. Also, the username and password prompts aren't taking. I still get the login promt.

aaa new-model

aaa authentication password-prompt Password:

aaa authentication username-prompt Username:

aaa authentication login default group tacacs+ local

aaa authentication login con group tacacs+ local

aaa authentication enable default group tacacs+ enable

tacacs-server host 10.10.40.50 key 7 XXXXXXXXXXXXXXX

enable secret 5 XXXXXXXXXXXXXXXXXXXXXXXXXXX

line con 0

no modem enable

line aux 0

line 2

no activation-character

no exec

transport preferred none

transport input all

line 3

no exec

line vty 0 4

length 0

transport input ssh

Thanks again.

The Need for Enable Password

mauzamor — Mon, 19 Nov 2012 16:08:41 GMT

That's the expected behavior, if you want to change this behavior then you are missing one command:

aaa authorization exec default group tacacs+ local

Use this command and let me know how it goes.

The Need for Enable Password

Patrick McHenry — Mon, 19 Nov 2012 18:51:54 GMT

Thanks, Mauricio - it worked.

The Need for Enable Password

mauzamor — Mon, 19 Nov 2012 18:55:20 GMT

Patrick,

Excellent news, have a nice day.

Re: The Need for Enable Password

Patrick McHenry — Mon, 19 Nov 2012 19:08:28 GMT

Can you think of any reason that my prompt isn't changing?

It still says login as: Then, password: instead of Username: then, Password:.

Thanks, pat.