cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1745
Views
5
Helpful
7
Replies

AAA question

kelly.conley
Level 1
Level 1

Greetings,

I am the process of updating and standardizing our AAA configs. This is a current section:

 

aaa authentication login default group tacacs+ local
aaa authentication login console none
aaa authorization config-commands
aaa authorization exec default group tacacs+ if-authenticated
aaa authorization exec console none
aaa authorization commands 15 default group tacacs+ if-authenticated

 

My question is are "aaa authentication login console none" and "aaa authorization exec console none" doing anything? I remember being told years ago they are there for some obscure login scenario but I cant remember what it is. Taking them out doesn't seem to have any effect. Thoughts?

7 Replies 7

Hi,

With your config, console access is blocked. Any user who tries to access
console and authenticate with fail. Some high security firms adopt that
model but the counter to this that you can't do console troubleshooting.

**** please remember to rate useful posts

Thanks for the response. You would think that is the case but it is not.
Console access works with a local user as well as with tacacs.

Seb Rupik
VIP Alumni
VIP Alumni

Hi there, 

The none keyword instructs the aaa AuthC process to not look at any user datastores. The credentials must be stored on the line. What does sh run | beg line con look like?

 

cheers,

Seb.

line con 0
exec-timeout 30 0
logging synchronous

This is very strange. Based on your config, console access shouldn't work.

Open an ssh session, debug aaa authentication with term monitor, then login
to console and post the output. Let's see what happens.

***** please remember to rate useful posts

So when the tacacs is available console login does not work. 

Jan 14 17:39:51.965: AAA/AUTHEN/LOGIN (0000001B): Pick method list 'default'

So I assume that this:

aaa authentication login default group tacacs+ local

is being used. when tacacs is not available console access fails to local even if "aaa authentication login console none" is used.

It appears that because I have this line:

aaa authentication login default group tacacs+ local

 

Then this line:

aaa authentication login console none

 

That "login default" applies to the console and therefore "aaa authentication login console none" does nothing and console access is allowed if tacacs is not available.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: