I am trying to allow an ssh session to auto-enable on my ASA. I am enable to ssh to the asa with the public key and get directly to a non-enabled prompt, but I want that prompt to enter in enabled mode so that I can use the account for automation without storing passwords in a script.

Per the cisco docs, if you specify auto-enable on the aaa authorization exec LOCAL line, it should automatically put an inbound localdb user in enable mode.

Thinking that I might also need to set service-type, I set service-type admin on the user in question.

Relevant config:

aaa authentication ssh console tacacsgroup LOCAL
aaa authentication enable console tacacsgroup LOCAL
aaa authentication http console tacacsgroup LOCAL
aaa authorization command LOCAL
aaa accounting command tacacsgroup
aaa accounting enable console tacacsgroup
aaa accounting ssh console tacacsgroup
aaa authorization exec LOCAL auto-enable

And the user entry:

username redacted password redacted encrypted privilege 15
username redacted attributes
 service-type admin
 ssh authentication publickey re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed hashed
  • What version of ASA are you running? – Benjamin Dale Dec 30 '16 at 9:43
  • Are you running at least ssh v.1.99 ideally 2.0? Can you switch on ssh debug? #debug ssh 19 – Datagram.Network Feb 3 '17 at 21:34
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 9 '17 at 17:06

I just tested with ASA 9.1.7 and found that telnet and ssh with password authentication works fine with "auto-enable", but ssh with publickey does not. A workaround is to push the enable sequence to each ssh session:

notroot@ubuntu:/www$ ssh $'en\n\n'
Type help or '?' for a list of available commands.
LABNET-CORE-ASA5510-1# <you are left here>

If you're industrious, open up a TAC case and ask Cisco to fix the bug.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.