The statement in my prior post - "Remove the contents of the subcommand list (right-hand list), select the "Deny" radio button, Submit your changes to the Command Authorization Set, and retest."
... should have included, selecting the Permit Unmatched Args checkbox.
In order to test the "show" command with the "interfaces" argument, you may need to add the enable command.
Consider the following example:
"Deny" radio button selected (i.e.: only listed commands will be authorized).
Command List:
disable
enable
show
"Show" command arguments set as follows:
(a) Deselect the "Permit Unmatched Args" checkbox.
(b) Enter the following argument into the list:
permit interfaces Loopback 0
This will result in the ability to show the Loopback 0 interface, but NOT the GigabitEthernet interface (per your indicated preference).
Notes:
Command arguments are case sensitive and may differ from how they are entered at the CLI.
A sniffer is helpful in determining proper case.
Wireshark is capable of decrypting TACACS+ packets if you configure the application with the password.
If you were to limit the "show" command argument to "permit interfaces", and then tried to use the "interfaces" command with the "deny GigabitEthernet X" argument, you would not see the results desired. The "show" command with its limited argument would authorize showing of the GigabitEthernet X interface despite configuration of the "interfaces" command.
I'm not a fan of this user interface.
