cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

Configuring ACS 5.x for Restricted Dev Admin Command Set

Mike Masalla
Beginner
Beginner

Hi every one there,

I am not new to ACS business, but this is the first time I am about to configure ACS 5.3 to authorize user group from doing some commands in the "configure mode" while permitting them some other commands. As example, I want to deny them from doing "reload" but give them access to configure "time-range", what happen is, they are denied access to "reload" on the exec mode, but once they went into "configure" mode, they would be able to "do reload"

I mean to say, is it possible to manage the subsequent commands to "configure terminal" ?

Thanks

1 ACCEPTED SOLUTION

Accepted Solutions

Jagdeep Gambhir
Advocate
Advocate

Mike,

If this is IOS then make sure we have this command added,

aaa authorization config-command

This will authorize all commands executed in config t mode.

Regards,

~JG


Do rate helpful posts

View solution in original post

4 REPLIES 4

Jagdeep Gambhir
Advocate
Advocate

Mike,

If this is IOS then make sure we have this command added,

aaa authorization config-command

This will authorize all commands executed in config t mode.

Regards,

~JG


Do rate helpful posts

Thanks for this info :-) 5+

Thanks & Regards

Amjad Abdullah
Engager
Engager

Mike,

Like Jagdeep replied above, if you use that command on the IOS device (switch or router) then once you are on privileged mode you'll have all commands permitted.

You have to configure the ACS however to restrict access to the reload command for users in the enable mode.

This example will help you if you don't have an idea about the configuration already:

http://www.cisco.com/en/US/products/ps9911/products_configuration_example09186a0080bc8514.shtml

Regards,

Amjad

Rating useful replies is more useful than saying "Thank you"

Rating useful replies is more useful than saying "Thank you"

Mike Masalla
Beginner
Beginner

Thanks Jagdeep, yes I am applying the commands to an IOS device. I have added your magic aaa authorization config-command  to IOS device aaa policy and tested it, looks great. Thank you very much.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: