Hi.. My name is Fabio, I work on brazil like network manager. I placed Tac_plus to work on Linux, because it is needed to restrict some users accesses to routers. In the first case where users are able to give show and config commands referring "RTR" that works well for show commands but not when user this inside config mode.
See log below.
Wed Oct 13 22:43:38 2004 10.121.9.66 test tty2 192.168.32.8 stop task_id=210 timezone=GMT-3 service=shell start_time=1097729277 priv-lvl=15 cmd=configure terminal
Wed Oct 13 22:43:48 2004 10.121.9.66 test tty2 192.168.32.8 stop task_id=211 timezone=GMT-3 service=shell start_time=1097729287 priv-lvl=15 cmd=line console 0
see the cofig
group = users {
default service = deny
service = exec {
priv-lvl = 15
}
}
##############################
#All services are alowed..
user = DEFAULT {
service = ppp protocol = ip {}
}
user = test {
login = cleartext xxxx
member = users
service = exec {
priv-lvl= 15 }
cmd = enable {
permit .* }
cmd = configure {
permit "terminal" }
cmd = rtr {
permit .* }
cmd = show {
permit "rtr"
deny .* }
cmd = exit {
permit .* }
}
My problem is, in config mode the user test have a full authorization command.
Thanks...
Fábio
