2

I have a following very minimalistic AAA configuration in ISR router with IOS 12.4(22)T:

aaa new-model
aaa authentication login default group tacacs+ enable
aaa authentication enable default group tacacs+ enable
aaa authorization exec default group tacacs+ 
aaa session-id common

After authentication I end up in privilege level 15. Now if execute commands like conf t or show ver, the router does not consult with TACACS+ server(I run a packet capture on TACACS+ server TCP port 49). What exactly the aaa authorization exec default group tacacs+ does? When does the command authorization happen?

  • 2
    By minimalistic, you mean that you haven't really got a tacacs+ server configured? You have to tell ios where the server is, there isn't a magic find the server function in ios – Mike Pennington Apr 6 '15 at 15:01
  • Sorry, I didn't mention this in my initial post. TACACS+ server is configured with tacacs-server host 10.10.10.3 key passwd command. – Martin Apr 7 '15 at 7:01
  • 1
    Command authorization uses the aaa authorization commands ... syntax. – cpt_fink Apr 12 '15 at 22:22
5
+100

The statement

aaa authorization exec default group tacacs+

allows you to start a CLI session (a command shell). Without it, you can't get a command prompt.

You can see more information here.

EDIT: From: http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_cfg_authorizatn.html#wp1058237

AAA Authorization Types

Cisco IOS software supports five different types of authorization: •Auth-proxy—Applies specific security policies on a per-user basis. See "Related Documents" section for more information about where to find authentication proxy configuration documentation.

•Commands—Applies to the EXEC mode commands a user issues. Command authorization attempts authorization for all EXEC mode commands, including global configuration commands, associated with a specific privilege level.

•EXEC—Applies to the attributes associated with a user EXEC terminal session.

•Network—Applies to network connections. This can include a PPP, SLIP, or ARAP connection.

•Reverse Access—Applies to reverse Telnet sessions.

•Configuration—Applies to downloading configurations from the AAA server.

•IP Mobile—Applies to authorization for IP mobile services.

I think the confusion comes from the difference in how different TACACS daemons respond. Cisco ACS may respond differently than your Shrubbery daemon or tacacs.net.

Here is some more reference material, although not exactly what you're asking for: TACACS Attribute-Value Pairs

| improve this answer | |
  • Actually you will get a command prompt without the aaa authorization exec default group tacacs+ command. All one needs is aaa new-model, aaa authentication login default group tacacs+ enable and tacacs-server host 10.10.10.3 key passwd. – Martin Apr 7 '15 at 7:10
  • What ios version are you running? – Ron Trunk Apr 7 '15 at 10:16
  • As I mentioned in my initial post, I'm running IOS 12.4(22)T(c1841-spservicesk9-mz.124-22.T.bin). – Martin Apr 7 '15 at 13:00
2

It seems to me that aaa authorization exec default group tacacs+ command forces TACACS+ client(Cisco ISR router in my case) to take account the service = exec configuration snippet in TACACS+ daemon(tac_plus from http://www.shrubbery.net/tac_plus/) configuration file. For example:

service = exec {
  priv-lvl = 15
  autocmd = "show version"
}

If I remove the aaa authorization exec default group tacacs+ command I end up in IOS shell in privilege level 1 and show version is not automatically executed. However, I would like to have an authoritative answer and does this command have any other purpose?

| improve this answer | |
1

aaa authorization exec default group tacacs+

https://www.ccexpert.us/cisco-secure/configuring-aaa-authorization.html

aaa authorization {auth-proxy | network | exec | commands level | reverse-access | configuration | ipmobile} {default | list-name} [method1 [method2]]

AAA authorization controls the user's activity by permitting or denying access to what type of network access a user can start (PPP, SLIP, ARAP), what type of commands the user can execute, and more.

exec - Applies to a user EXEC terminal session.

default - Uses the listed authentication methods that follow this argument as the default list of methods for authorization.

list-name - Character string used to name the list of authentication methods.

method - Specifies at least one of the keywords that follow.

group / group-name - Uses a subset of RADIUS or TACACS+ servers for authentication as defined by the aaa group server radius or aaa group server tacacs+ command.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.