Introduction
IOS-XR has a very strong embedded mechanism to do user authentication and authorization. While XR does not have the concept of privilege-levels as what IOS had, the embedded user task group management is extremely strong allow for the creation of different task groups.
Tasks
Building blocks for on-box authorization scheme
4 types of permissions per task
Tasks |
aaa | config-services | hsrp | netflow | sbc |
acl | crypto | interface | network | snmp |
admin | diag | inventory | ospf | sonet-sdh |
atm | disallowed | ip-services | ouni | static |
basic-services | drivers | ipv4 | pkg-mgmt | sysmgr |
bcdl | eigrp | ipv6 | pos-dpt | system |
bfd | ext-access | isis | ppp | transport |
bgp | fabric | logging | qos | tty-access |
boot | fault-mgr | lpts | rib | tunnel |
bundle | filesystem | monitor | rip | universal |
cdp | firewall | mpls-ldp | root-lr | vlan |
cef | fr | mpls-static | root-system | vrrp |
cisco-support | hdlc | mpls-te | route-map | |
config-mgmt | host-services | multicast | route-policy | |
Default task-groups
The following task-groups are predefined in IOS-XR
root-system: Root system users
root-lr: Root logical router users
netadmin: Network administrators
sysadmin: System administrators
operator: Operators performing day-to-day activities
cisco-support: highest level of privilege allowing lowest level access
What task group is needed for what command?
If you are unsure as to what task group and permission level you need in order to allow a certain command, use the "describe" keyword.
Example:
RP/0/RSP0/CPU0:A9K-TOP#describe show bgp summary
.....
User needs ALL of the following taskids:
bgp (READ)
So in order to allow a user to do the command "show bgp summary", we would need to allow the following line in
the task group definition:
task read bgp
It can also be the case that a particular user needs to be member of a particular (pre defined) task group.
such as a Process restart, you can only do when you are member of cisco-support:
RP/0/RSP0/CPU0:A9K-TOP# describe process restart bgp
.........
User needs ALL of the following taskids:
cisco-support (EXECUTE)
Tasks and user group example
In regular IOS-XR configuration define your task-group with the permissions and tasks you like
RP/0/RSP0/CPU0:A9K-TOP(config)#taskgroup basic-admin
RP/0/RSP0/CPU0:A9K-TOP(config-tg)# task read acl
RP/0/RSP0/CPU0:A9K-TOP(config-tg)# task read bfd
RP/0/RSP0/CPU0:A9K-TOP(config-tg)# task read bgp
RP/0/RSP0/CPU0:A9K-TOP(config-tg)# task write acl
RP/0/RSP0/CPU0:A9K-TOP(config-tg)# task write bfd
RP/0/RSP0/CPU0:A9K-TOP(config-tg)# task write bgp
RP/0/RSP0/CPU0:A9K-TOP(config-tg)# task debug bgp
You can also define a user group that imports several task groups:
usergroup noc-staff
taskgroup operator
taskgroup basic-admin
inherit usergroup all-users
Privilege levels
As mentioned, XR doesn't have priv levels, but in order to leverage the existing AAA profiles from TACACS used for IOS based routes, we can create user-groups that are named as the privilege levels:
usergroup priv15
taskgroup root-system
taskgroup cisco-support
Now with tacacs we can send the priv via the options in service-exec:
service = exec {
priv-lvl = 15
}
or via a radius AVP like:
cisco-avpair = "shell:priv-lvl=15"
NOTE: the syntax of "cisco-avpair" and the capitalization is dependent on the dictionary definition for the cisco avp.
Using AAA
For starters you need to point your user authentication to the external source for authentication:
aaa authorization exec default group tacacs+ local
aaa authentication login default group tacacs+ local
when you add the following to your tacacs profile :
TACACS:
service = exec {
task = "rwx:bgp,#operator"
}
RADIUS:
Cisco-AVPair = "shell:tasks=#sysadmin,rwx:bgp,r:ospf"
you'll inherit the read, write and execute permissions to BGP as well as the user will be part of the local operator group definition.
Either this group is part of the standard cisco embedded groups or it can be something that you have defined locally.
the radius profile allows read/write/execute on BGP, read for OSPF and membership to the sysadmin group
By using AAA you can either reference locally defined task groups OR you can define the task groups in the tacacs/radius response packet
or using a combination of both
Group Membership
To find out which groups you are currently member of while being logged in:
RP/0/RSP0/CPU0:A9K-TOP#show user tasks
Wed Mar 30 18:26:00.768 UTC
Task: aaa : READ WRITE EXECUTE DEBUG
Task: acl : READ WRITE EXECUTE DEBUG
Task: admin : READ WRITE EXECUTE DEBUG
Command Authorization
In IOS we can do command authorization for each separate priv level. in XR we don't have priv levels hence either command author is enabled for ALL commands or none at all:
RP/0/RSP0/CPU0:A9K-TOP(config)#aaa authorization commands default group ?
WORD server-group name
tacacs+ Use list of all TACACS+ hosts
Note: in order to do command author you must use TACACS, you cannot use radius.
Related Information
n/a
Xander Thuijs - CCIE #6775
Sr Tech Lead ASR9000
