TACACS+ and authorization "conf-t" commands (IOS)

[o-evdokimov]

Hi

Is it possible to do authorization for IOS commands ("conf-t mode") on the TACACS + service without having to keep strings as "privilege configure level 3 interface" in the cisco running config?

Authorization for exec mode commands works well but I need the same for the commands of conf-t mode.

For example tac_plus.conf:

I need something like this (fictional syntax):

    service = configure {

       cmd = interface { permit FastEthernet .* }

       cmd = switchport { deny access .* }

    }

it's already works well:

    service = exec {

       priv-lvl = 3

    }

    cmd = ping { permit .* }

    cmd = wrire { deny memory }

Thank you for any ideas.

[Tushar Gaba · Accepted solution]

Hi Oleg ,

The very first thing you need to do is to make sure an authorization packet is sent to Tacacs Server for commands at config terminal mode .For this we need command on IOS .
"aaa authorization config-commands"

Now rest of the work has to be done on Tacacs-Server defining each command with specific arguments as you mentioned .


Sent from Cisco Technical Support Android App

[o-evdokimov]

It's work. Thank you, Tushar.

[sriramojurajiv · Accepted solution]

Hi Oleg,

here,as you said the commands like ping,show or any other commands in privilege level are authorized with tacacs+ server.but if you want to authorize in global configuration mode then you need to give an extra command

"acs#aaa authorization config-commands"

now after giving you can give any global configuration commands like

"acs(config)#interface FastEthernet "

either you permit or deny.this command gets  authorizes with tacacs+ server.

-thanks,

Rajiv

[o-evdokimov]

Rajiv, thank you for help too.