topic Re: AAA authorization for console connection in Network Access Control

AAA authorization for console connection

gcyeaw — Fri, 21 Feb 2020 18:05:02 GMT

I have a user configured in the TACACS server to receive privalege level 15. When that user telnets to a router he gets level 15, but when he connects via the console he only gets level 1. A debug trace shows only the authentication, there is no authorization exchange for the console connection. Is there a parameter I am missing?

aaa new-model

aaa authentication login default group tacacs+ local

aaa authentication ppp if-needed group tacacs+ local

aaa authorization exec default group tacacs+ none

Re: AAA authorization for console connection

4brown — Thu, 07 Nov 2002 15:04:29 GMT

What version of IOS are you using? There are some issues with this in older versions of IOS.

If your IOS supports it, try using the:

aaa authorization console

command.

If not, assign a list to the console and see if this works such as:

aaa authorization exec CONSOLE default group tacacs+

line con 0

author exec CONSOLE

Let us know if this works.

Re: AAA authorization for console connection

Nairi Adamian — Thu, 07 Nov 2002 23:48:26 GMT

As per the following Samle Configuration:

http://www.cisco.com/warp/public/480/8.shtml

Console port authorization was not added as a feature until Bug ID CSCdi82030 was implemented. Console port authorization is off by default to lessen the likelihood of accidentally being locked out of the router. If a user has physical access to the router via the console, console port authorization is not extremely effective. However, for images in which Bug ID CSCdi82030 has been implemented, console port authorization can be turned on under line con 0 with the hidden command aaa authorization console.

Hope this helps,

-Nairi

Re: AAA authorization for console connection

gcyeaw — Fri, 08 Nov 2002 13:42:40 GMT

Yes, that was the solution.

I notice that once the hidden command is entered and the config saved to startup, it survives a reboot, however, there is no way to tell that it is there other than logging into the console and seeing the result.

Re: AAA authorization for console connection

gcyeaw — Fri, 08 Nov 2002 13:45:29 GMT

I had tried the list already along with a host of other variations. I am running 12.2-7a. 'aaa authorization console' solved the problem. Thanks!