ACS - Shell Command Authorization Sets

[steve pearson]

Hi,

I have had a problem where a set of users in two groups in ACS are struggling entering commands.  The commands are set in the Shell Command Authorization Sets and this hasnt changed.  Other commands are working.  As this is spanning two groups in ACS I am thinking it's not something with the groups but the command sets itself.

Just to check, the commands are 'clear port-security' and clear mac address-table' - I have entered in Command 'clear' and the following attributes;

permit port-security
permit mac address-table'

I've also ticked 'Permit unmatched args'

At the same time as this is occuring I have been recieving the following messages from the ACS server via email;

Test Timed out for service: CSAdmin
Test Timed out for service: CSAuth
Test Timed out for service: CSDbSync
Test Timed out for service: CSLog

I have looked at other posts and have restarted CSMon.  This then stops the messages for some time, then a day or so later I get the messages again.

Could this be tied in with the command issue?  Is there something else I should look at other than restarting the server and the CSMon service again?  All other CS' services are running.

Thanks!!

Steve

[Nicolas Darchis]

When you are failing to authorize the commands, what is the error message ? It would be interesting to see a package.cab of that

What version of ACS are you running by the way ?

And when you restart CSMon and the message doesn't appear for a day, is your command problem gone too ?

Nicolas

[steve pearson]

Thanks for your reply!

there are no errors, the switch ios is putting the asterics as it does when you enter a command that is not recognised, i.e. for clear port-security the port-security onwards is not recognised.  On this note, the user is entered into priviledge mode and not in configure terminal mode, just base priviledge mode.  The group in ACS is set to max priviledge level 7 and have also set this on the user account in addition.

I am using ACS v 4.1.

While I receive the service messages and also when they go away - I always have the authorisation problem.

Thanks

Steve