ACS and Secure Computings Safeword

[lisbeth.jacobsen]

Hi,

I am trying to set up one time enable authentication using Safeword version 3.1.1 and Cisco Secure ACS v. 3.2.

So far I have configured the unknown user database to use the safeword server as an authentication database. Within ACS I have mapped a group to the safeword server and ticked shell(exec) as well as the privilege level which I have set to 15.

On the router I point aaa authentication to the tacacs+ server.

I can connect to the router using my token and get correctly assigned to the group I have pointed at the safeword server. I am, however, presented with the user (>) prompt rather than the exec (#) prompt. Does anyone have any advice as to what I am doing wrong.

Regards

Lisbeth

[Richard Burts]

I think you may not properly understand what setting the privilege level in ACS does. It sounds like you expect that if you set the level to 15 that when a user logs in they will automatically be at level 15 (functionally the equivalent of setting the privilege level with the user <...> privilege 15 command on the router). What setting the level in ACS does is to indicate the highest level that the user can authenticate to.

Have you tested by logging in to the router, getting into user mode (and associated with the proper group in ACS) and then enter the enable command? I believe you may find that it prompts for password and authenticates you to enable privilege level.

HTH

Rick

[lisbeth.jacobsen]

Hi Rick,

Thanks for taking a look. What I am trying to do is to get the ACS to pass on authentication requests to the Safeword server and upon success having the authenticated user get directly to the exec prompt.

What is happening at the moment is, as you point out, that I have to execute the enable command and log in using a static enable password configured on the router. I am trying to do away with the static password (except of course in times of network problems) and replace it with a one time password using the Safeword token server.

Regards

Lisbeth

[Richard Burts]

Lisbeth

Do I understand correctly that you are authenticating correctly for user mode using ACS and the Safeword but not authenticating for enable mode? If so it would be helpful if you could post all of the aaa part of your config.

HTH

Rick

[lisbeth.jacobsen]

Hi Rick,

I am not sure if you do. I can authenticate to the router using my token. That gets me to the > prompt. I then have to type in "enable" and enter the static password for that. That gets me to the # prompt.

What I want to do is bypass step one and useing the token authentication get directly to the # prompt. aaa config is simple:

aaa authentication login default group tacacs+ enable

as I want tacas+ to supply authorization functionality.

As I said I have configured the unknown user database to pass authentication requests to our Safeword server.

Lisbeth