topic Re: ACS - Shell Command Authorization Sets in Network Access Control

ACS - Shell Command Authorization Sets

steve pearson — Mon, 11 Mar 2019 00:41:59 GMT

Hi,

I have had a problem where a set of users in two groups in ACS are struggling entering commands. The commands are set in the Shell Command Authorization Sets and this hasnt changed. Other commands are working. As this is spanning two groups in ACS I am thinking it's not something with the groups but the command sets itself.

Just to check, the commands are 'clear port-security' and clear mac address-table' - I have entered in Command 'clear' and the following attributes;

permit port-security
permit mac address-table'

I've also ticked 'Permit unmatched args'

At the same time as this is occuring I have been recieving the following messages from the ACS server via email;

Test Timed out for service: CSAdmin
Test Timed out for service: CSAuth
Test Timed out for service: CSDbSync
Test Timed out for service: CSLog

I have looked at other posts and have restarted CSMon. This then stops the messages for some time, then a day or so later I get the messages again.

Could this be tied in with the command issue? Is there something else I should look at other than restarting the server and the CSMon service again? All other CS' services are running.

Thanks!!

Steve

Re: ACS - Shell Command Authorization Sets

Nicolas Darchis — Sat, 08 Jan 2011 08:14:25 GMT

When you are failing to authorize the commands, what is the error message ? It would be interesting to see a package.cab of that

What version of ACS are you running by the way ?

And when you restart CSMon and the message doesn't appear for a day, is your command problem gone too ?

Nicolas

Re: ACS - Shell Command Authorization Sets

steve pearson — Sat, 08 Jan 2011 14:10:30 GMT

Thanks for your reply!

there are no errors, the switch ios is putting the asterics as it does when you enter a command that is not recognised, i.e. for clear port-security the port-security onwards is not recognised. On this note, the user is entered into priviledge mode and not in configure terminal mode, just base priviledge mode. The group in ACS is set to max priviledge level 7 and have also set this on the user account in addition.

I am using ACS v 4.1.

While I receive the service messages and also when they go away - I always have the authorisation problem.

Thanks

Steve