1

Related to Authenticate ssh key via Cisco ACS (TACACS+)

Given a working ssh public key config:

ip ssh pubkey-chain
 username admin
  key-string
   <ssh-pub-key>
  exit
 exit

I have only been able to provide authorization for the above with an additional username entry:

username admin privilege 15

Nice to discover that you can leave off the secret part, but is there a way to have the cisco query the radius for the privilege level? and/or combine the authorization into the pubkey-chain?

  • RADIUS is limited, but you can do what you want with TACACS. – Ron Maupin Sep 1 '16 at 14:16
  • @RonMaupin Do you have a reference? Or a search string? – ericx Sep 1 '16 at 14:28
  • Unfortunately, resource recommendations are off-topic, but you can just search for TACACS. – Ron Maupin Sep 1 '16 at 14:29
  • "TACACS+ is a CISCO designed extension to TACACS that encrypts the full content of each packet. Moreover, it provides granular control (command by command authorization)." – Ron Maupin Sep 1 '16 at 14:31
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 1:32
1

If the radius server supports cisco av-pair attributes then you can configure it to push:

cisco-avpair =shell:priv-lvl=15

Note that this requires authorization to be enabled in addition to authentication.

Src: How to Assign Privilege Levels with TACACS+ and RADIUS

0

Here's a great link for Windows 2012r2 and cisco. I know it's not great to just supply a link but it's so helpful I wanted to share. If I could do a comment instead I would.

Link for server 2012r2 and Cisco

  • sadly, this link has no mention of ssh keys... – ericx Sep 6 '16 at 23:51
0

To provide an answer to silence this question: Ron Maupin provided the best clue. Basically you can't use RADIUS to provide ssh keys.

TACACS is a very nice protocol; but it won't work because not enough non-cisco devices will use it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.