I am trying to allow an ssh session to auto-enable on my ASA. I am enable to ssh to the asa with the public key and get directly to a non-enabled prompt, but I want that prompt to enter in enabled mode so that I can use the account for automation without storing passwords in a script.
Per the cisco docs, if you specify
auto-enable on the
aaa authorization exec LOCAL line, it should automatically put an inbound localdb user in enable mode.
Thinking that I might also need to set service-type, I set
service-type admin on the user in question.
aaa authentication ssh console tacacsgroup LOCAL aaa authentication enable console tacacsgroup LOCAL aaa authentication http console tacacsgroup LOCAL aaa authorization command LOCAL aaa accounting command tacacsgroup aaa accounting enable console tacacsgroup aaa accounting ssh console tacacsgroup aaa authorization exec LOCAL auto-enable
And the user entry:
username redacted password redacted encrypted privilege 15 username redacted attributes service-type admin ssh authentication publickey re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed hashed