topic Tacacs + AAA in Network Access Control

Tacacs + AAA

fabioosantos — Sun, 10 Mar 2019 20:51:51 GMT

Hi.. My name is Fabio, I work on brazil like network manager. I placed Tac_plus to work on Linux, because it is needed to restrict some users accesses to routers. In the first case where users are able to give show and config commands referring "RTR" that works well for show commands but not when user this inside config mode.

See log below.

Wed Oct 13 22:43:38 2004 10.121.9.66 test tty2 192.168.32.8 stop task_id=210 timezone=GMT-3 service=shell start_time=1097729277 priv-lvl=15 cmd=configure terminal

Wed Oct 13 22:43:48 2004 10.121.9.66 test tty2 192.168.32.8 stop task_id=211 timezone=GMT-3 service=shell start_time=1097729287 priv-lvl=15 cmd=line console 0

see the cofig

group = users {

default service = deny

service = exec {

priv-lvl = 15

}

##############################

#All services are alowed..

user = DEFAULT {

service = ppp protocol = ip {}

}

user = test {

member = users

service = exec {

priv-lvl= 15 }

cmd = enable {

permit .* }

cmd = configure {

permit "terminal" }

cmd = rtr {

permit .* }

cmd = show {

permit "rtr"

deny .* }

cmd = exit {

permit .* }

}

My problem is, in config mode the user test have a full authorization command.

Thanks...

Fábio

Re: Tacacs + AAA

scottosan — Thu, 21 Oct 2004 15:00:54 GMT

How did you configure the routers? The config should look something along the lines of this with some room for variation:

aaa new-model

aaa authentication login default group tacacs+ line

aaa authorization exec default group tacacs+ if-authenticated

aaa authorization commands 0 default group tacacs+ if-authenticated

aaa authorization commands 1 default group tacacs+ if-authenticated

aaa authorization commands 15 default group tacacs+ if-authenticated

aaa authorization config-commands

Re: Tacacs + AAA

fabioosantos — Thu, 21 Oct 2004 15:59:58 GMT

I didn't place the command "aaa authorization config-commands" in my configuration. I am going to place and to verify the result.

Thank´s

Fábio

Re: Tacacs + AAA

fabioosantos — Thu, 21 Oct 2004 17:11:30 GMT

Hi,

Scottosan,

The command aaa authorization config-commands fixed my problem. Thank´s you very much.

Regards,

Fábio

Re: Tacacs + AAA

scottosan — Thu, 21 Oct 2004 17:28:35 GMT

your welcome