SCP

Unanswered Question
Oct 23rd, 2006
User Badges:
  • Bronze, 100 points or more

Greetings,


I'm trying to get Secure Copy (SCP) working to a Cisco switch configured to authenticate access via TACACS+ off Cisco ACS.


I've read the SCP documentation (http://www.cisco.com/en/US/customer/products/sw/iosswrel/ps1839/products_feature_guide09186a0080087b18.html) and enabled SSH and SCP as described. I can SSH into the switch without a problem.


However, when I try and use scp from a unix workstation to copy startup-config (scp [email protected]:nvram/startup-config startup-config) I get the error "Privilege denied."


I assume that this is because the user "craig" (configured in Cisco ACS) needs to "enable" to get to privilege 15 in order to access the file "nvram:startup-config".


The examples in the SCP configuration document uses a local privilege 15 user (username superuser privilege 2 password 0 superpassword) which does not need to "enable".


How do you achieve this using Cisco ACS? I can't find anywhere is Cisco ACS to configure a user to have privilege 15 by default. Am I missing something?


Any help would be greatly appreciated.


Craig

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Craig Balfour Mon, 10/23/2006 - 03:20
User Badges:
  • Bronze, 100 points or more

About 10 minutes after posting this problem I figured out the solution myself.


In Cisco ACS | Group Setup | Edit Settings | TACACS Settings check Privilege level and set it to 15.


This only works if the following AAA configuration line is also present on the Catalyst device:


aaa authorization exec default group tacacs+



Actions

This Discussion