How to configure the aaa authorization command on the console port of Cisco IOS router with local authentication

[TCC_2]

Core issue

This is how you apply the authorization command on the console port of router with local authentication and allow only preconfigured commands for the user.

Resolution

In order to configure this feature on Cisco IOS  routers, refer to this configuration example. In this example, MENU is used and it allows the show logging and show tech commands to be available for the support user.

• Create username and password with this command:

username username privilege 15 password password
username username autocommand menu HELPDESK

• Enable AAA authentication and authorization:
  
  aaa authentication login console local
  aaa authorization exec console local
  aaa authorization console
  !-- This is a hidden command.

• Configure MENU from the commands that the user is authorized to use and apply it to the console:
  
  menu HELPDESK text 1 Logging
  menu HELPDESK command 1 show logging
  menu HELPDESK options 1 pause
  menu HELPDESK text 2 Tech Support
  menu HELPDESK command 2 show tech-support
  menu HELPDESK options 2 pause
  menu HELPDESK text 3 Exit
  menu HELPDESK command 3 exit
  
  line con 0
  login authentication console
  authorization exec console