cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

194
Views
5
Helpful
7
Replies
Highlighted
Beginner

AAA question

Greetings,

I am the process of updating and standardizing our AAA configs. This is a current section:

 

aaa authentication login default group tacacs+ local
aaa authentication login console none
aaa authorization config-commands
aaa authorization exec default group tacacs+ if-authenticated
aaa authorization exec console none
aaa authorization commands 15 default group tacacs+ if-authenticated

 

My question is are "aaa authentication login console none" and "aaa authorization exec console none" doing anything? I remember being told years ago they are there for some obscure login scenario but I cant remember what it is. Taking them out doesn't seem to have any effect. Thoughts?

7 REPLIES 7
Highlighted
VIP Advisor

Hi,

With your config, console access is blocked. Any user who tries to access
console and authenticate with fail. Some high security firms adopt that
model but the counter to this that you can't do console troubleshooting.

**** please remember to rate useful posts
Highlighted

Thanks for the response. You would think that is the case but it is not.
Console access works with a local user as well as with tacacs.
Highlighted
VIP Advisor

Hi there, 

The none keyword instructs the aaa AuthC process to not look at any user datastores. The credentials must be stored on the line. What does sh run | beg line con look like?

 

cheers,

Seb.

Highlighted

line con 0
exec-timeout 30 0
logging synchronous
Highlighted

This is very strange. Based on your config, console access shouldn't work.

Open an ssh session, debug aaa authentication with term monitor, then login
to console and post the output. Let's see what happens.

***** please remember to rate useful posts
Highlighted

So when the tacacs is available console login does not work. 

Jan 14 17:39:51.965: AAA/AUTHEN/LOGIN (0000001B): Pick method list 'default'

So I assume that this:

aaa authentication login default group tacacs+ local

is being used. when tacacs is not available console access fails to local even if "aaa authentication login console none" is used.

Highlighted

It appears that because I have this line:

aaa authentication login default group tacacs+ local

 

Then this line:

aaa authentication login console none

 

That "login default" applies to the console and therefore "aaa authentication login console none" does nothing and console access is allowed if tacacs is not available.

Content for Community-Ad