I think there is something wrong with your tac_plus configuration.
I am using version c2960-lanbasek9-mz.122-25.SEE4.bin and
I have NO such issue. See below.
Here is my tac_plus configuration:
[root@dca2-LinuxES root]# more /etc/tacacs/tac_plus.cfg
accounting file = /var/log/tac_plus.log
key = zFgGkIooIsZ.Q
user = cciesec {
member = admin
name = "rancid user"
login = des xxxxxxx
}
user = $cciesec$ {
member = admin
name = "rancid user"
login = des yyyyyyy
}
user = test {
member = limited
login = des xxxxxxx
name = "tester"
}
user = $test$ {
member = limited
login = des xxxxxx
name = "tester"
}
group = limited {
default service = deny
cmd = show {
permit "ip .*"
permit "debugging .*"
deny .*
}
cmd = debug {
permit .*
}
cmd = exit { permit .* }
cmd = enable { permit .* }
}
group = admin {
default service = permit
}
[root@dca2-LinuxES root]# telnet 192.168.0.5
Trying 192.168.0.5...
Connected to 192.168.0.5 (192.168.0.5).
Escape character is '^]'.
C
*****************
User Access Verification
Username: test
Password:
C2960>en
Password:
C2960#sh run
Command authorization failed.
C2960#sh ver
Command authorization failed.
C2960#
When I log in with an "admin" account, I can do just about
everything:
[root@dca2-LinuxES root]# telnet 192.168.0.5
Trying 192.168.0.5...
Connected to 192.168.0.5 (192.168.0.5).
Escape character is '^]'.
C
*****************
User Access Verification
Username: cciesec
Password:
C2960>en
Password:
C2960#conf t
Enter configuration commands, one per line. End with CNTL/Z.
C2960(config)#end
C2960#exit
Connection closed by foreign host.
[root@dca2-LinuxES root]#
As you can see, even when the user has level 15 privilege, I can still restrict
what he/she can do, as desmonstrated with account "test". That's the beauty
with tacacs authorization.
