Unanswered Question
Oct 23rd, 2006
User Badges:
  • Bronze, 100 points or more


I'm trying to get Secure Copy (SCP) working to a Cisco switch configured to authenticate access via TACACS+ off Cisco ACS.

I've read the SCP documentation ( and enabled SSH and SCP as described. I can SSH into the switch without a problem.

However, when I try and use scp from a unix workstation to copy startup-config (scp [email protected]:nvram/startup-config startup-config) I get the error "Privilege denied."

I assume that this is because the user "craig" (configured in Cisco ACS) needs to "enable" to get to privilege 15 in order to access the file "nvram:startup-config".

The examples in the SCP configuration document uses a local privilege 15 user (username superuser privilege 2 password 0 superpassword) which does not need to "enable".

How do you achieve this using Cisco ACS? I can't find anywhere is Cisco ACS to configure a user to have privilege 15 by default. Am I missing something?

Any help would be greatly appreciated.


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Craig Balfour Mon, 10/23/2006 - 03:20
User Badges:
  • Bronze, 100 points or more

About 10 minutes after posting this problem I figured out the solution myself.

In Cisco ACS | Group Setup | Edit Settings | TACACS Settings check Privilege level and set it to 15.

This only works if the following AAA configuration line is also present on the Catalyst device:

aaa authorization exec default group tacacs+


This Discussion