Can you add/modify ACS 5.2 CLI user roles?

[s.chamberlin]

My company's security group uses Tripwire to monitor for changes in start-config and running-config on network devices in PCI scope.  We are migrating from ACS v4.2 to v5.2.  I need to create the account for Tripwire on the ACS Appliance but did not want to assign the admin role which would give access to configure terminal.  The user role does not have privileges for show start-config or show running-config.  Am I missing something or are these the only 2 roles available at the CLI?  Can another rolle be added?

[GregCover]

What you need to remember about the show running-config command is that the user running the command will only be allowed to see what they are authorized to configure.  Keeping that in mind and so the tripwire user account can see "all" the running config, create a rule to allow this Tripwire user to authorize at the privilege 15 shell level and then apply a special limited command set (which you will need to create) that only allows the commands that the account needs to function.

Hope this helps!

Greg