topic Problem with shell command authorization in Network Access Control

Problem with shell command authorization

dtangent — Sun, 10 Mar 2019 14:26:32 GMT

I ran into this issue with both ACS 3.1 and ACS 3.2

A shell command authorization set is created under the shared profile components with the following settings:

Unmatched Commands: deny

Permit Unmatched Args: UNCHECKED

The command allowed is "show", with Arg "permit ver", "permit interface", and "permit run"

This authorization set is then applied to the group, under the option "Assign a Shell Command Authorization set for any network device."

Enable option for that group is set to "Max Privilege for any AAA Client, level 15"

This configuration is then tested against two IOS switches, with the aaa commands as follow:

aaa new-model

aaa authentication login default group tacacs+ local

aaa authentication enable default group tacacs+ enable

aaa authorization exec default group tacacs+ local

aaa authorization commands 15 default group tacacs+ local

The problem I am having is that when an user that falls under this group logs in, he/she can issue commands such as show ver, show run, and show int just like I would expect it to. Any command that doesn't start with a show.... is denied. However, other show commands that are not listed in the Args will work, while some won't. For example, "show arp" and "show vlan" worked, while "show accounting" and "show buffer" didn't. What am I missing?

Re: Problem with shell command authorization

yusuff — Tue, 12 Aug 2003 05:33:50 GMT

commands that are working without you defining them explicitly are of lower Privilege level than 15... eg; 'show arp' is a Priv-1 command, hence it is execuatbel without command authorization as you are not doing command authorization for Priv-1.

Router>sh priv

Current privilege level is 1

Router>

Router>show arp

Protocol Address Age (min) Hardware Addr Type Interface

Internet 10.1.5.2 24 0000.abcd.abcd ARPA Ethernet0/0

Internet 10.1.5.3 - 0003.abcd.abcd ARPA Ethernet0/0

Router>

Re: Problem with shell command authorization

dtangent — Tue, 12 Aug 2003 15:57:26 GMT

Adding the aaa command, "aaa authorization commands 1 default group tacacs+ local" fixed it. Thanks for the response.

Re: Problem with shell command authorization

m.penta — Wed, 03 Sep 2003 14:06:59 GMT

I have the same problem, and adding the "aaa authorization commands 1 default group tacacs+" command the results is the same: it doesn't work correctly...

I have:

"Unmatched Cisco IOS commands"---> Deny

"Command"---> show

"Arguments"---> permit ip route

"Unlisted arguments"---> deny

These parameters are the same in the group and in the user setting, but I've tried several solution, with no good results...

The version of CiscoSecure is 2.4 for WinNT.

There is a solution?