ACS 5.3 Shell Command Set

siangyankhoo — Mon, 11 Mar 2019 02:08:55 GMT

Hi all,

Currently i deploy a ACS 5.3 at customer site. The issue i face currently is some command sets no able to deny. Example like below:

i want to deny the AD user with priviledge level 15 to change the enable secret password and delete the enable secret password.

the command i issue at below:

deny enable secret -> working

deny no enable secret -> no working

Anyone got idea to make the no working argument become working?

mauzamor — Thu, 31 May 2012 13:08:01 GMT

Hi there,

I just did a test in my ACS using your requirements and it worked fine, check below my configuration it may help you:

I am using the following AAA commands:

Switch(config)#do sh run | i aaa

aaa new-model

aaa authentication login default group tacacs+ local

aaa authorization config-commands

aaa authorization exec default group tacacs+ local

aaa authorization commands 0 default group tacacs+ if-authenticated

aaa authorization commands 1 default group tacacs+ if-authenticated

aaa authorization commands 15 default group tacacs+ if-authenticated

aaa session-id common

Switch(config)#

Rate if it helps!

topic ACS 5.3 Shell Command Set in Network Access Control