topic Re: shell command authorization set in Network Access Control

shell command authorization set

james-benson — Sun, 10 Mar 2019 22:49:57 GMT

umatched commands set to deny

command "configure" argument "permit terminal"

user has full access to all. i just want user to adjust vty lines. I also have the following commands

show with argument"permit run and start"

thats all i have set up in command. they should not be able to do anything in the config mode "Yet"

Re: shell command authorization set

Jagdeep Gambhir — Thu, 08 May 2008 14:01:39 GMT

James,

Please check out this link and attached file,

http://cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml

Regards,

~JG

Do rate helpful posts

Re: shell command authorization set

james-benson — Thu, 08 May 2008 14:24:23 GMT

I actually set up the commands using that document. it is supposed to deny anything else once you are in the config mode. because i have no other commands or arguments defined. but i have full control

Re: shell command authorization set

Jagdeep Gambhir — Thu, 08 May 2008 14:44:17 GMT

Do you have this command in config

aaa authorization config-command

Re: shell command authorization set

jong_r0602 — Thu, 08 May 2008 14:54:21 GMT

Hi James,

Is there a privilege level defined on your vty? Especially if theres a privilege level is 15, remove it first then try it again.

Regards,

Jong

Re: shell command authorization set

james-benson — Thu, 08 May 2008 15:36:32 GMT

there is no privilege defined on vty

Re: shell command authorization set

james-benson — Thu, 08 May 2008 15:38:37 GMT

i do not have that in my config. I do not know where i would put it. here is my config

aaa new-model

aaa authentication login default group tacacs+ line

aaa authentication login no_tacacs enable

aaa authentication enable default group tacacs+ enable

aaa authorization commands 1 default group tacacs+ if-authenticated

aaa authorization commands 15 default group tacacs+ if-authenticated

aaa authorization network default group tacacs+

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 1 default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

aaa accounting network default start-stop group tacacs+

Re: shell command authorization set

Jagdeep Gambhir — Thu, 08 May 2008 15:42:47 GMT

You need issue that command in config t mode

aaa authorization config-command

That will take care of your issue.

Regards,

~JG

Do rate helpful posts

Re: shell command authorization set

jong_r0602 — Fri, 09 May 2008 02:19:36 GMT

ok, all you have to do is to follow JG's instruction above on his previous mail to enter the "aaa authorization config-command" in config t mode.

Thanks,

Jong