I am not an expert with TACACS+ but I've been using
TACACS+ on linux for the past five years so that I
am quite familiar with this.
First of all, what you should is look in google
for the enable.c file. Replace your enable.c file
with the new one. With this file, it will allow
each user to have his/her own enable password
WITHOUT sharing password. That is the prefer way
of doing thing.
Furthermore, what you're trying to do require
AAA authorization. In other words, I can give
someone level-15 privilege but that does not mean
he/she can reload the router. Here is what you want
aaa authentication login VTY group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization console
aaa authorization config-commands
aaa authorization exec notac none
aaa authorization exec VTY group tacacs+ if-authenticated none
aaa authorization commands 0 VTY group tacacs+ if-authenticated none
aaa authorization commands 1 VTY group tacacs+ if-authenticated none
aaa authorization commands 15 VTY group tacacs+ if-authenticated none
aaa authorization network VTY group tacacs+ if-authenticated none
in the tacplus configuration, you need something like this:
group = admin {
default service = permit
}
group = advanced {
cmd = show { permit .* }
cmd = copy { permit flash }
cmd = copy { permit running }
cmd = ping { permit .* }
cmd = configure { permit .* }
cmd = interface { permit .* }
cmd = "no shutdown" { permit .* }
cmd = shutdown { permit .* }
cmd = enable { permit .* }
cmd = disable { permit .* }
cmd = telnet { permit .* }
cmd = disconnect { permit .* }
cmd = where { permit .* }
cmd = set { permit .* }
cmd = clear { permit line }
cmd = exit { permit .* }
}
user = adv {
member = advanced
name = "Advanced User"
login = cleartext "adv123"
# login = des DJVS9kfrcLbus
}
user = $adv$ {
member = advanced
name = "Advanced User"
login = cleartext "adv1234"
# login = des W/3UA7J1cz3sQ
}
user = cciesec {
member = admin
name = "rancid user"
login = cleartext "cciesec"
}
user = $cciesec$ {
member = admin
name = "rancid user"
login = cleartext "cciesec1"
}
This should give something for you to start.
Have fun!!!!!!
CCIE Security
