1

Privilege level 15 in IOS has all the possible commands for particular IOS release enabled. However, for example privilege level 1 has only few dozens of commands available. Now if I want to allow some of the privilege level 15 commands also for privilege level 1, then I could use the privilege exec level 1 <command> command. For example privilege exec level 1 traceroute. However, is there a way to do this centrally in TACACS+ server?

1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 10 '17 at 2:46
3

Yes, this is the exact purpose of the second "a" in "aaa". Authorization is the process of limiting which commands a user is able to execute based on their user/group profile.

There are many different products that provide aaa services in a centralized manner, some paid and some free.

1

Definitely yes. I personally prefer this tacacs+ implementation http://www.pro-bono-publico.de/projects/tac_plus.html And use setup similar to http://blog.one-it.de/open-source-multidevice-multiuser-tacacs/ Relevant portion of the config is USERGROUPS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.