tclsh authorization failed

[william.deloraine]

Hello,

I've got an issue in executing a tclsh script.

router(tcl)#exec "ping 192.168.0.1 repeat 1 time 1"
Command authorization failed.

router(tcl)#show privilege
Current privilege level is 15
router(tcl)#exec "ping 192.168.0.1 repeat 1 time 1"
Command authorization failed.router(tcl)#

Here is my aaa config:

aaa authentication login default group tacacs+ local
aaa authentication login no_tacacs local
aaa authentication enable default group tacacs+ enable
aaa authorization config-commands
aaa authorization exec default if-authenticated
aaa authorization commands 0 default group tacacs+ if-authenticated
aaa authorization commands 1 default group tacacs+ if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated

My image version is s72033-advipservicesk9_wan-mz.122-33.SXI3.bin.

Could you help me on this subject?

Regards,

[Joe Clarke]

What version of IOS is this?  This is most likely CSCsu65401.

[Joe Clarke]

Ugh, I just saw your image.  Sorry.  Yeah, this is the bug I mentioned, but I don't see it fixed in the SXI train.  I'll see about getting this fix integrated.

[william.deloraine]

Hi Joseph,

Thanks for your answer.

Actually, I found some elements regarding bugs but I was thinking it's regarding authorization in AAA configuration.

Regards,

[Joe Clarke]

No, the problem is the bug.  Another customer is reporting the same thing on SXI.  A workaround would be to use the Embedded Event Manager's Tcl interface, and configure "event manager session cli username USER" (where USER is a username authorized to run all of the commands).  It's a bit trickier to execute CLI commands using EEM Tcl, but it will work for you.  For example:

::cisco::eem::event_register_none
namespace import ::cisco::eem::*
namespace import ::cisco::lib::*
if { [catch {cli_open} result] } {
    error $result $errorInfo
}
array set cli $result
cli_exec $cli(fd) "enable"
set output [cli_exec $cli(fd) "ping 192.168.1.1 repeat 1"]
puts $output
catch {cli_close $cli(fd) $cli(tty_id)}