Wildcard mask in Shell Command Authorization Set?

[ccoutts]

Under Shared Profile Components/Shell Command Authorization Sets in ACS, is it possible to enter a wildcard for further arguments.

For example, say you want to permit show cam [+ all arguments], is it possible to configure show, then 'permit cam *' as the argument?

Thanks

[gfullage]

Sure. Just tested this on my ACS 3.2 server with the following config:

AAA client:

aaa new-model

aaa authentication login default tacacs

aaa authorization commands 1 default group tacacs

ACS Shell Command Set:

Unmatched Commands = Deny

Command = show

Permit unmatched args = no

args = permit ip *

This then allows me to do "sho ip int brief" and "sho ip http server all" to name a couple, but doesn't allow me to do "sho ver".

Hope that helps.

[ccoutts]

Thanks very much.

Best regards,

Charles