Radkit readonly/limited_commands_policy?

[Andrii Oliinyk]

Does anybody know how-to limit Remote User for limited set of commands/ReadOnly?
so far i was only able to figure out an approach with using reduced privileges user for Terminal access to arbitrary Device in Device's settings. meaning u need to create device's AAA user outside of RadKit.
Any other ideas?

[Torbjørn]

We landed on the conclusion that authorization must be handled externally to radkit as well.
I would too be very interested if there is a better way to do this.

[Andrii Oliinyk]

my approach would be generating (up to 13) privelege-set(s) on the device & then bind corresponding privelege-level to either local user or radius or tacacs user (by returning specific privelege in AccessAccept for last 2). & then creation of the Device-instance corresponding to defined privilege-level by using corresponding user's creds in Device-settings for Terminal.
yes, it's painful, but i dont see anything else.
what is your approach if it's not a secret?

but from my pov lack of this feature in RADKit is serious weakness of this platform.

[Rana Khalil]

@Andrii Oliinyk 

Hello Andrii,

This is Rana, I work with RADKit support team.

Thanks for sharing your concerns and opening this discussion.

Please check the external sources method: We have a way to configure external sources and device templates for easier device credential management.

 https://radkit.cisco.com/docs/service/external_sources.html

There is also another very simple way to limit what users can do when they terminally access the device (very high level but worth mentioning):

Our RADKit team is more than happy to answer any further technical concerns you might have.

Regards,

RK

[Andrii Oliinyk]

Hi Rana
thanks for input. any hints on scopes of Interactive, Exec, Upload & Download? Intuitively i ussume that Exec covers all exec mode commands, upload/download may be about "copy" command, etc but more details would give more help.
Thank u

[Rana Khalil · Accepted solution]

Hi Andrii,

Sure! So for Interactive it's just a normal CLI terminal login as if we are SSHing into a device on a Webex. Exec, running single command on single device or multiple commands on multiple devices..etc, for upload/download it's copying files back and forth locally or uploading to a SR.

For more details:

https://radkit.cisco.com/docs/client/client_guide.html#starting-radkit-client

Thanks,

RK

[Andrii Oliinyk]

thanks. i've just created external source with tacacs & tried to create device-template with use of "external_source: tacacs_1 & received validation error

sorry, i cannot copy text there as it's protected env.
what is the reason for this error & how to remediate?

[Rana Khalil]

Hey @Andrii Oliinyk ,

Can you open SR for RADKit support to take a proper look into this? The steps will be the normal case opening procedure with choosing RADKit as a technology after picking a license for any device added in RADKit inventory.

If you have problems with that, please feel free to inbox me the email that you use with Cisco.

[Andrii Oliinyk]

can we try maybe 1st other way around? do you have an example of how to configure tacacs remote_source for device authentication? 

  external_source:
    # Optional reference to external source (default: null)
    name: external_source_name
    # Mandatory string
    params:
      key1: value1
      # Optional keys and values can use template stringsso far i did it like in 

so far i did it like in the docs except of that meaningless keyX pairs. so i'm trying to put only "name: radiator"
where radiator is a name of tacacs server i defined in External sources

[Andrii Oliinyk · Accepted solution]

just noticed i made syntax error. now it's Ok

thanks

[Rana Khalil]

You are most welcome.

If I may ask, what version of RADKit service you are on? It's because there are lots of improvements in the most recent release to help our customers with this feature and it will only keep improving!

[Andrii Oliinyk]

1.8.8. i believe it's latest