AAA authentication and Authorization

[salemmahara]

Hello eveyone

Here is a simple configuration of TACACS+ . Authentication is ok, enable password is checked, but after entering to Privilege mode (Router#) there is a problem with authorization. logged in user can perform allllll commands :) :

aaa new-model

aaa authentication login TEST group tacacs+

aaa authorization enable default group tacacs+

aaa authorization exec TEST group tacacs+

aaa authorization network TEST group tacacs+

line vty 0 4

login authentication TEST

authorization exec TEST

I tried to deny all commands on TACACS+ server but ...

May I have your ideas please?

[Francesco Molino · Accepted solution]

Hi

You're missing some aaa statements to ask the device to check all commands typed in by a user against tacacs:

aaa authorization config-commands

aaa authorization commands 1 TEST group default local if-authenticated

aaa authorization commands 0 TEST group default local if-authenticated

aaa authorization commands 15 TEST group default local if-authenticated

!

line vty 0 15

 authorization commands 1 TEST

 authorization commands 0 TEST

 authorization commands 15 TEST

Here a complete doc: https://communities.cisco.com/servlet/JiveServlet/downloadBody/68194-102-1-125121/How-To_TACACS_for_IOS.pdf

[salemmahara · Accepted solution]

Hi Ferancesco

Thanks for replying.

aaa authorization config-commands was forgotten

[Francesco Molino]

You're welcome