Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

permitting specified commands only

Hi,

We have TACACS enabled in our routers. I wanted to restrict user access to only particular commands. I am providing those commands below.

Router#term len 0

Router#sh clock

Router#sh ip int br

Router#sh env all

Router#sh int s0/0

Router#sh int s0/1

Router#ping 10.30.250.137

Router#conf t

Router(config)#int se0/0

Router(config-if)#no backup int br0/0

Router#exit

Router#isdn call int bri 0/0 22861600

Router#sh isdn a

Router#sh isdn status

Router(config)#int se0/0

Router(config-if)#backup int bri0/0

Router#sh int bri0/0

Router#sh run

Nothing more than these commands should be allowed for configuration. Can someone advice me for required configuration in Router as well as cisco ACS.

Regards

SKRAO

2 REPLIES
Silver

Re: permitting specified commands only

Re: permitting specified commands only

I have done this before on ACS. You need to do the following;

setup a "Shell Command Authorization Set" which is under shared components. You will need to add the commands you want to permit then select the "deny unmatched arguments" box. When this is setup you need to link it to the required ACS group.

This set is linked under the group under the "Shell Command Authorization Set" section.

146
Views
0
Helpful
2
Replies
CreatePlease login to create content