I am trying to allow an ssh session to auto-enable on my ASA. I am enable to ssh to the asa with the public key and get directly to a non-enabled prompt, but I want that prompt to enter in enabled mode so that I can use the account for automation without storing passwords in a script.
Per the cisco docs, if you specify auto-enable on the aaa authorization exec LOCAL line, it should automatically put an inbound localdb user in enable mode.
Thinking that I might also need to set service-type, I set service-type admin on the user in question.
Relevant config:
onion rings mozzarella sticks 6pc strips
aaa authentication ssh console tacacsgroup LOCAL
aaa authentication enable console tacacsgroup LOCAL
aaa authentication http console tacacsgroup LOCAL
aaa authorization command LOCAL
aaa accounting command tacacsgroup
aaa accounting enable console tacacsgroup
aaa accounting ssh console tacacsgroup
aaa authorization exec LOCAL auto-enable
And the user entry:
username redacted password redacted encrypted privilege 15
username redacted attributes
service-type admin
ssh authentication publickey re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed hashed