topic Re: Exec Authorization for router's console and Radius in Network Access Control

Exec Authorization for router's console and Radius

g.rodegari — Sun, 10 Mar 2019 14:48:30 GMT

Hi all,

i've configured my router's authentication and authorization in this fashion:

username test privilege 15 password test

aaa authentication password-prompt password:

aaa authentication username-prompt login:

aaa authentication login vty group radius local

aaa authentication login console group radius local

aaa authorization exec default group radius local

line con 0

line vty 0 4

and i've configured Microsoft IAS radius server with two groups:

admin with shell-priv-level= 15

and Operator with shell-priv-level= 1.

When I try on vty, all works well: admin log on router with privilege 15 (already in enable mode) and operator with privilege 1...

but on console all users have level 1 privilege...

any ideas?

thanks in advance,

Graz.

Re: Exec Authorization for router's console and Radius

gfullage — Thu, 20 May 2004 02:33:14 GMT

Authorization on the console port is turned off by default, even with authorization enabled globally. This was done on purpose as we had a large number of people lock themselves out of their router when configuring authorization, and we wanted the console port to always be a backdoor entry. The theory is that if someone has access to your console port, you have a lot more to worry about than command or exec authorization 🙂

If you really, really want to enable authorization on the console port, add the following hidden command into your router and you should be good to go:

aaa authorization console

Re: Exec Authorization for router's console and Radius

g.rodegari — Thu, 20 May 2004 06:27:36 GMT

Hi Glenn,

thank you very much!

I'm completely agree with you:

to have console security, first you should have physical security...

regards,

Graz.