ACS 4.2 creating authorization set for restricted access

Waruna Wijewardena · ‎05-28-2009

Hi,

I am trying to creat user group who are assigned for restricted access only for ping <ip> repeat command and show interface <x/x> at the user exec prompt .

These users are not required to log with enable password to do this above task.

Can anyone help with group edit settings for authorization set . Most probably i hope command & arguments to be used .

My device (AAA client ) configuration is as follows:

aaa new-model

aaa authentication login default group tacacs+ local

aaa authorization commands 0 default group tacacs+ if-authenticated

aaa authorization commands 1 default group tacacs+ if-authenticated

aaa authorization commands 15 default group tacacs+ if-authenticated

aaa accounting exec default start-stop group tacacs+

aaa accounting commands 0 default start-stop group tacacs+

aaa accounting commands 1 default start-stop group tacacs+

aaa accounting commands 15 default start-stop group tacacs+

aaa accounting system default start-stop group tacacs+

Appreciate your help !

regards,

Waruna

Jagdeep Gambhir · ‎05-28-2009

Waruna,

Trick here is to give all user a priv 15 and then define command autho set as per your need.

Giving priv 15 does not mean that user will able to execute all commands. You can set up authorization set and allow only specific commands you want user should be able to execute.

This is what you need on IOS device,

Router(config)# username [username] password [password]

tacacs-server host [ip]

tacacs-server key [key]

aaa new-model

aaa authentication login default group tacacs+ local

aaa authorization exec default group tacacs+ if-authenticated

aaa authorization commands 1 default group tacacs+ if-authenticated

aaa authorization commands 15 default group tacacs+ if-authenticated

aaa authorization config-commands

On acs bring users/groups in at level 15

1. Go to user or group setup in ACS

2. Drop down to "TACACS+ Settings"

3. Place a check in "Shell (Exec)"

4. Place a check in "Privilege level" and enter "15" in the adjacent field

Please see this link,

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml

Regards,

~JG

Do rate helpful posts