AAA question...user access to switch

[the-lebowski]

I have a scenario where some users would the like the ability to change port vlan assignment which I am fine with.  However is there a way to limit which ports they can assign or what they can do overall?  Or is it all or nothing when allowing users that level of config changes?

[Thotsaphon Lueangwattanaphong]

Hi,

  You can define privilege levels for users. You can allow users to use specific commands you want. Just check out these links.

Ref:

http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a00800949d5.shtml

http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a008009465c.shtml

HTH,

Toshi

[the-lebowski]

I read that link already but it didnt make it clear to me.  Care to share an example of a local user account only given access to conf t, int gig X and switchport access vlan X?

Found this as well, much more in-depth:

http://www.cisco.com/en/US/docs/ios/12_2t/12_2t13/feature/guide/ftprienh.html

[Thotsaphon Lueangwattanaphong · Accepted solution]

Hi,

   Have you tried it?  You can do the following command for testing.  Let's say users will be assigned to privilege level 5.

!

aaa new-model

!

aaa authentication login default local

aaa authorization exec default local

!

username username privilege 5 password 0 abcd

!

privilege interface level 5 switchport mode access

privilege interface level 5 switchport access vlan

privilege configure level 5 interface

privilege exec level 5 configure terminal

privilege exec level 5 show running

!

      I think they would see types of interfaces. If you want to allow them to check what they have done, "show running" is fine.

HTH,

Toshi

[the-lebowski]

I tried it like that but the user is prompted for enable password after logging in.  Obivoulsy I don't want them to have that enable password and would prefer if they were just dropped into the enable prompt after logging in. 

However I don't have this statement in my config:

aaa authorication exec default local

[Thotsaphon Lueangwattanaphong]

Hi,

   Just try commands I told you. Did you already have "aaa new-model" configured on it.  Please post the current configuration.

Toshi

[the-lebowski]

Important parts below, when I login as usera_admin it prompts me for the enable password.  Does privilege level matter? 

username usera_admin privilege 5 password 7 06170E701E1D5D

aaa new-model

!

!

aaa authentication login default local

!

!

privilege interface level 5 switchport

privilege configure level 5 interface

privilege exec level 5 configure terminal

privilege exec level 5 configure

privilege exec level 5 show vlan

privilege exec level 5 show

!

!

line con 0

line vty 0 4

access-class 10 in

exec-timeout 0 0

transport input ssh

line vty 5 15

!

end

[Thotsaphon Lueangwattanaphong]

Hi,

   What do you mean "it prompts me for the enable password"?  You should see the output below after loggin in.

switch#

switch#show privilege

Current privilege level is 5

Toshi

[the-lebowski]

I mean when I login as usera_admin and enter the password I am greeted by the user prompt.

switch> and NOT switch#

SO I went ahead and added this line:

aaa authorization exec default local

And that did it.

switch#show privilege

Current privilege level is 5

sw4-data-ann#

Thank you!

[the-lebowski]

One more question, if I wanted to specify specific ports is there a way to do that without doing invdividual 'interface gi1/0/x, interface gi1/0/x, etc...'

Thanks

[Thotsaphon Lueangwattanaphong]

Hi Dave,

    I think the device won't allow you to specific more than "privilege configure interface". 

HTH,

Toshi