aaa Autorisation commands

giaaaj — Fri, 21 Feb 2020 06:29:55 GMT

Hallo iam trying to configure ACS & my Network devices to restrict the use of some commands for a group of users, i have another group ( Networking group) this group have the privileged level 15 and should be able to do evry thing. The group that i would like to restrict commands for have the name show-commands group.

i configured the following :

on ACS

- i definded a user that ist a member of the group show-commands

- by group TACACS+ Settings i checked Shell (exec) and Privilege level (5)

- by Shell Command Authorization Set i checked <Assign a Shell Command Authorization Set for any network device> , and used an Authorization Set name <lehrling> that i already configured in shared profiles components.

- Shell Command Authorization Set < lehrling > is configured as follows:

Name : lehrling

Unmatched Commands: - Deny is checked

- permit unchecked

- permit unmached Args unchecked

********************

- in the window on the left hand i put the following commands

Debug

- on the right hand i put deny all

***************

i repeated this for logout, ping and tracerout with nothing in the window on the right hand

- i put also show on the left hand and

permit ver

permit running-config

permit ip interface brief

on the right hand

On the router i configured the following

< aaa authorization commands 5 default group tacacs+>

i tried also to use the name of the Authorization Set <lehrling> insted of default in the command above.

for the user in the group show-commands , i see that they the command mentioned above have no effect, and i cann't notice the restrictions that i made.

what i would like to do is to restrict config terminal for a group but this group should be able to use all other cammands like Debug.

Thanks

Re: aaa Autorisation commands

giaaaj — Thu, 16 Jan 2003 15:47:54 GMT

we are using ACS 3.0 on Windows 2000

topic aaa Autorisation commands in Network Security

aaa Autorisation commands

Re: aaa Autorisation commands