topic Great !Please mark the answer in Network Access Control

Tacacs+ config help

robprescott — Wed, 13 Mar 2019 00:42:54 GMT

Having some trouble with a tacacs config..

I can SSH into my 3560 switch with a tacacs configured username / password but commands like write mem or dir display an error message.

The command 'write <cr>' is not authorized for user [username] and client [ip addr]

aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization config-commands
aaa authorization exec default group tacacs+ if-authenticated
aaa authorization commands 1 default group tacacs+ if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa session-id common

Hi Rob,As everything is

edwjames — Fri, 04 Apr 2014 17:29:18 GMT

Hi Rob,

As everything is Tacacs+ specific.

If the command is not being authorized, this has be checked on the Tacacs+ server.

What is the Tacacs+ server that you are using?

Regards

tacacs.net is the software. I

robprescott — Fri, 04 Apr 2014 18:09:11 GMT

tacacs.net is the software.

I'm digging through the documentation, but its quite lousy IMHO.

I'll start troubleshooting this from a server authorization perspective, I just found I can rename the authorization.xml to authorization.xml.old. I've tested and now I have full control over commands.

Looks like I'll have to tweak this list of commands / permissions and rename again get this working.

Thanks for pointing me in the right direction.

-Rob

Great !Please mark the answer

edwjames — Fri, 04 Apr 2014 18:26:57 GMT

Great !

Please mark the answer as resolved so others can take guidance with the same type of issue.

Regards

Re: tacacs.net is the software. I

deependra8010 — Fri, 07 Dec 2018 05:46:23 GMT

Hi,

I am also facing same problem. I have done all the steps as you provided in your post but same problem. When i tried to use scp with aaa tacacs server.

Re: tacacs.net is the software. I

deependra8010 — Fri, 07 Dec 2018 05:50:45 GMT

Hi,

How to check scp command authorization on ACS tacacs server.

Re: Hi Rob,As everything is

deependra8010 — Fri, 07 Dec 2018 05:53:34 GMT

Hi,

How to check scp command authorization on ACS tacacs server.