PIX 6.2 AAA authorization

[vr2zjw]

I am trying to assign some show command to privilege level 1 such that our first line support can telnet to the PIX and do some command without going into enable mode. I assign the show interface command to privilege level 1 but I can't execute the command in privilege level 1, why? Here is my output. Thanks you.

PIX# show pri command inter

privilege show level 1 command interface

privilege clear level 15 command interface

privilege configure level 15 command interface

PIX# dis

PIX> show curp

Username : enable_1

Current privilege level : 1

Current Mode/s : P_UNPR

PIX> show interface

Type help or '?' for a list of available commands.

PIX> show ?

checksum View configuration information cryptochecksum

curpriv Display current privilege level

history Display the session command history

pager Control page length for pagination

version Display PIX system software version

PIX> show ?

checksum View configuration information cryptochecksum

curpriv Display current privilege level

history Display the session command history

pager Control page length for pagination

version Display PIX system software version

PIX> ?

enable Turn on privileged commands

help Help list

login Log in as a particular user

logout Exit from current user profile, and to unprivileged mode

pager Control page length for pagination

quit Quit from the current mode, end configuration or logout

PIX>

[p.krane]

It looks to be configured correctly according to the docs. I wonder if user “enable_1” is setup with priv level 1 in your AAA server. I’ve never used priv levels in PIX, I think it’s a fairly new feature so you might be running into a bug too.

[jraarons]

Last I checked AAA was used by the PIX to have users verify whether they are enabled for Internet access. Based upon username they may or may not be able to surf the web.

You have to give your admins enable access and hope they don't open the back door, then close it behind them.

I have brought this basic lack of security to Cisco's attention for several years, maybe it will change in the future.

You need to be able to audit admins usage, record their changes, etc using TACACS+.

OSPF/BGP support would be helpful in redundant setups, which is why an ISP has trouble deploying firewalls.