Has anyone sucessfully implement command authorization on a PIX or FWSM?
My goal is to have three users (admin,backup,readonly) where admin user has all rights, the backup user can only issue the write net command, and the readonly can only do show commands.
I can sucessfully authenticate my tacacs users, but am getting stuck at the enable authentication. My tacacs+ server in debug mode gives the message:
enable query for 'admin' 24 from 10.1.2.4 rejected
Here is my tacacs config and my FWSM config:
user = $enable$ {
login = des xxxxx
}
user = $enab15$ {
login = des xxxxx
}
user = admin {
default service = permit
login = file /etc/passwd
}
user = backup {
login = nopassword
cmd = write { permit net
}
}
user = readonly {
login = des xxxxxx
cmd = show {
permit .*
}
cmd = quit {
permit .*
}
cmd = exit {
permit .*
}
cmd = * {
deny .*
}
}
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 1
aaa-server TACACS+ (outside) host 10.1.2.4 xxxxx timeout 10
aaa-server TACACS+ (outside) host 10.1.2.3 xxxxx timeout 10
aaa authentication ssh console TACACS+ LOCAL
aaa authentication enable console TACACS+ LOCAL
