Has anyone sucessfully implement command authorization on the PIX or FWSM? I seem to be stumbling on the enable authentication part. I can sucessfully authenticate a tacacs+ user, but when I try to authenticate the enable command, my tacacs server in debug mode returns the following:
enable query for 'admin' 24 from 10.1.2.4 rejected
Here is my tacacs and FWSM config:
user = $enable$ {
login = des xxxxx
}
user = $enab15$ {
login = des xxxxx
}
user = admin {
default service = permit
login = file /etc/passwd
}
user = backup {
login = nopassword
cmd = write { permit net
}
}
user = readonly {
login = des xxxxxx
cmd = show {
permit .*
}
cmd = quit {
permit .*
}
cmd = exit {
permit .*
}
cmd = * {
deny .*
}
}
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 1
aaa-server TACACS+ (outside) host 10.2.3.5 xxxxx timeout 10
aaa-server TACACS+ (outside) host 10.1.2.3 xxxxx timeout 10
aaa authentication ssh console TACACS+ LOCAL
aaa authentication enable console TACACS+ LOCAL
