topic Wildcard mask in Shell Command Authorization Set? in Network Access Control

Wildcard mask in Shell Command Authorization Set?

ccoutts — Sun, 10 Mar 2019 20:53:31 GMT

Under Shared Profile Components/Shell Command Authorization Sets in ACS, is it possible to enter a wildcard for further arguments.

For example, say you want to permit show cam [+ all arguments], is it possible to configure show, then 'permit cam *' as the argument?

Thanks

gfullage — Thu, 18 Nov 2004 05:06:14 GMT

Sure. Just tested this on my ACS 3.2 server with the following config:

AAA client:

aaa new-model

aaa authentication login default tacacs

aaa authorization commands 1 default group tacacs

ACS Shell Command Set:

Unmatched Commands = Deny

Command = show

Permit unmatched args = no

args = permit ip *

This then allows me to do "sho ip int brief" and "sho ip http server all" to name a couple, but doesn't allow me to do "sho ver".

Hope that helps.

ccoutts — Fri, 19 Nov 2004 21:16:21 GMT

Thanks very much.

Best regards,

Charles