AAA Local Authorization....

Hello all. Hopefully, this will prove to be an easy question with a simple answer!
I want to configure local username/passwords on my router, with different privilege levels. For example username admin is only allowed to access privilege level 1 commands, and username engineer is allowed to enter all comands (level 15). However, when I test this via console or telnet, both go into user mode to start with (Router>) and I can enter enable mode on both username logins by entering the enable password (Router#). Therefore, both username's have the same access rights (to all commands) even though they have different privilege levels. I thought the privilege level 1 account would not be allowed to issue level15 commands?
Can anyone point me in the right direction.....
aaa new-model
aaa authentication login default local
aaa authorization commands 1 default local
aaa authorization commands 15 default local
enable secret test
username admin privilege 1 password cisco1
username engineer privilege 15 password cisco2
Thanks.

Just typing enable defaults to enable 15
Careful look at the following commands should answer your question
Router6>enable ?
<0-15> Enable level
Router6(config)#enable password ?
0 Specifies an UNENCRYPTED password will follow
7 Specifies a HIDDEN password will follow
LINE The UNENCRYPTED (cleartext) 'enable' password
level Set exec level password
Router6(config)#enable password le
Router6(config)#enable password level ?
<1-15> Level number
Victor

Similar Messages

Configuring aaa local command authorization

i am a bit struggling with how to configure aaa local command authorization, i am not getting any material also for configuring it. Please tell me how to configure aaa local command authorization.. or possible give me some useful links for that..

Hi,
For aaa authorization command set.Kindly refer to link.
http://www.cisco.com/en/US/products/sw/iosswrel/ps1828/products_command_reference_chapter09186a00800ca5d4.html
I hope this help.Please rate this post.
cheers
Sachin

AAA command authorization in ACE

How do we enable AAA command authorization in the ACE module on 6500 switch.i dont find any aaa authorization commands in it .
Kind regards
Ullas

Hi,
See the ACE Security Guide - Chapter 2. You need to set a CiscoAVPair. How you do this will depend on the RADIUS software that you are using. It sounds like you're being put into Network-Monitor role by default. Quote from the manual:
"The user profile attribute serves an important configuration function for a RADIUS server group. If the user profile attribute is not obtained from the server during authentication, or if the profile is obtained from the server but the context name(s) in the profile do not match the context in which the user is trying to log in, a default role (Network-Monitor) and a default domain (default-domain) are assigned to the user if the authentication is successful."
There are postings in this and other Cisco fora about exactly how to set these values (which depends on your RADIUS server implementation).
HTH
Cathy

AAA local authentication

Hi all,
I have configured my remote switch with the following AAA local authentication configuration.
no enable secret
no username hotel
no aaa new-model
username s1umb3r password p3ac3fully
enable secret tryt0h@ckth!S!s1umb3r
aaa new-model
exit
wr
After I have saved the configuration, I am not able to login to switch remotely. Please advice me ASAP.
Now how would I get into router is there any possibility to get into router remotely?
IOS version 12.0(5)WC8
Your early response will be highly appreciated.
Regards,
Khan

What does the VTY line have for config?

FWSM: AAA authentication using TACACS and local authorization

Hi All,
In our setup, we are are having FWSMs running version 3.2.22 and users are authenticating using TACACS (running cisco ACS). We would like to give restricted access ( some show commands ) to couple of users to all devices. We do not want to use TACACS for command authorization.
We have created users on TACACS and not allowed "enable" access to them. I have also given those show commands locally on the firewall with privilege level 1. and enabled aaa authorization LOCAL
Now , those users can successfully login to devices and execute those show commands from priv level 1 except "sh access-list". I have specifically mentioned this
"privilege show level 1 mode exec command access-list" in the config.
Is there anything i am missing or is there any other way of doing it?
Thanks.

You cannot do what you are trying to do. For (default login you need to use the first policy matched.
you can diversify telnet/ssh with http by creating different aaa groups.
But still you will be loging in for telnet users (all of them) using one method.
I hope it is clear.
PK

AAA Local with Privilege Levels

The goal....
1. local usernames on a router to control access
2. Use privilege levels in the username command to reflect what a user is allowed to do
3. Define a set of commands available to users with privilege level 1
My trouble here is that I cannot seem to find this exact combination of commands for what I want to do on CCO or Google. I have tried several combinations and here is what I have so far, but its not working.
aaa new-model
aaa authentication login default local
aaa authorization commands 1 default local
username engineer priv 15 pass XXXX
username tech priv 1 pass XXXX
privilege exec level 1 traceroute
â¨privilege exec level 1 ping

Hi,
This link answers your question.
http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a00800949d5.shtml
aaa authori command is not reqd.
Regards,
~JG
Do rate helpful posts

AAA Local

Hi
I have defined on a router 2 usernames: admin and vpn.
I want the user admin to be the only accepted by the router to login for administrative purposes, whereas the vpn user must be the only one accepted for VPN remote access to the local LAN.
The authentication and the authorization has to be performed using ONLY local database configured on the router
So far i have defined this:
aaa authentication login default local
aaa authorization exec default local
aaa authorization network vpn-group local
username admin privilege 15
username vpn privilege 1
crypto isakmp profile Ike-1
match identity group remote
client authentication list vpn-group
isakmp authorization list vpn-group
I have seen however the user vpn is allowed to login to the the router and also the admin is allowed to establish a VPN tunnel if successfully authenticated.
Does anybody can enlight me?
Thank you anticipately

I wish to achieve this:
the only userid accepted, when authenticating with the VPN client to the router, must be the vpn user, the admin user must be rejected.
The vpn user then will be granted acces to the local resources.
At this point, if a connection to the router is needed (for troubleshooting or changes to the config), i want ONLY the only userid admin accepted.
In short: admin user has be used only to work on the router, vpn user only to gain access to local remote network
Thank you anticipately
CZ

Local authorization

Hi,
Is it possible to make authorization using local database (not tacacs or radius)?
I have username admin that has to have access to configuration on router. I also have usename and passwords for IPsec users, but they shouldn't have access to configuration. But both (if they know enable secret) can enter privilege level.
Here is the config output,:
aaa new-model
aaa authentication login USAUTH local
aaa authorization console
aaa authorization exec USAUTH local
aaa authorization commands 0 USAUTH local
aaa authorization commands 15 USAUTH local
username admin privilege 15 password 7 044D0E0D06
username user1 privilege 0 password 7 121013161C
username user2 privilege 0 password 7 121B0A051D
line con 0
authorization commands 0 USAUTH
authorization commands 15 USAUTH
authorization exec USAUTH
login authentication USAUTH

Your config looks appropriate to accomplish what you are trying to. I use this (usually as backup for TACACS), and it works great. Have you tried your config and had issues? The only difference from my working configs is I do not have aaa authoriz commands 0 and 15 in my config.
One side note, if it's a recent IOS I suggest using secret instead of password for your local users. That will prevent the password from being reversed if someone gets your config. For example:
username admin priv 15 secret mypassword
Hope this helps.

AAA commad authorization

Dudes
We had problem in replicatiing database to secondary ACS (4.2) server, Somehow I've managed to fix the issue by changing firewall inspection and shared secret.Now I've got new issue with "command authorization failed" after successfull authentication, This happends only when we bring secondary server service up, Not all the AAA clients having issues but for some for strange reason. Has anyone come across these sort of issue, Pls let me know what shall I do to fix this issue that I can not keep secondary server down for long time.
Thanks in advance
Rajesh

SCCP (skinny) inspection will break ACS 4.x/3.x database replication since both SCCP and replication use TCP/2000.
What reason does ACS give to reject the authorization requests?

ASDM (ASA9.1) won't fully initiated when configured AAA command authorization

ASA doesn't have any local account, all authentications is done via AAA.
On AAA, we have two "groups" both assigned to privilege_15, one group (A) can issue all commands, another group (B) only can issue command sets we defined.
Group A can login to ASDM without any problems.
Group B can pass the login pop up, then start to load ASDM window, at the bottom it does show login user has privilede 15, then it's stopped at "parsing running configuration..." asd login screen pops up again, and I cannot pass it.
I suspect it's somewhere in permisssion, can someone help? thanks.
Leo Song

Hello,
There are some commands that are required in order to load the ASDM
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command blocks
Make sure you have them
Looking for some Networking Assistance?
Contact me directly at [email protected]
I will fix your problem ASAP.
Cheers,
Julio Carvajal Segura
http://laguiadelnetworking.com

AAA command authorization ASA

I have aaa authentication working on my ASA with no problem. I have command authorization working for my account on all my IOS devices with TACACS+ and a Cisco ACS. I can not get command authorization to work on the ASA. Every time I enter the 'aaa authorization command CSACS-TACACS+' the system will not let me do anything else and gives me a user not authroized and the ACS shows no log of this request. I then have to reboot the ASA to get back in.
Current commands
aaa authentication ssh console CSACS-TACACS+
aaa authentication http console CSACS-TACACS+
Entered commands
aaa authentication enable console CSACS-TACACS+
aaa authorization command CSACS-TACACS+

Douglas,
Try the following configuration:
aaa authentication ssh console CSACS-TACACS+
aaa authentication http console CSACS-TACACS+
aaa authentication enable console CSACS-TACACS+
With the previous settings the ASA should be authenticating your username/password and the enable password against the ACS server, if this part works fine then authorization should also be working fine.
Remember to keep another session open in privilege mode before testing "
aaa authentication enable console CSACS-TACACS+" command. In the ACS server you should be seeing at least the authentication passed report.

AAA & local login

Hi,
I've got a curious problem.
If I use the following line in my configs:
aaa authentication login default group tacacs+ local
and a locally configured usernam/password as follows:
username test password abc123
the ACS server will authenticate the login request ok every time. but if you try and log-in with the local username it fails. If you disconnect the ACS server then the local username and password will work.
Presumably the ACS server sees that there is no username that matches this local one and fails the attempt.
Is there a way to make it return to the router and make it use the local username?
Thanks for you help.
Ray

May be i am replying this too late, but there is a way to get both working, given if nothing has been changed in the code, which i have seen lately in few cases.
Issue command,
aaa authentication login default local group tacacs+
The above command will let both local and tacacs accounts to work. But ensure that local and tacacs accounts does not have same username.
Login behind this is,
first router will look up its local database, if a user is not found then router returns the code "ERROR". And "ERROR" is the code responsible for aaa statement to look for the next method available i.e. tacacs as per the command.
But other way around is not correct. That is, if you have command,
aaa authentication login default group tacacs+ local
Then if the account does not exist on the tacacs server, then tacacs server returns an error code "FAIL" not "ERROR", so it never looks local database on Router.
But when Tacacs server is not available, the router times out and generates error code "ERROR", which lets router checks its local database.
Regards,
Prem

Export User Accounts/AAA Local Database from 4404 WLC

Hi,
Guest User Accounts have been created in the local database of the WLC 4404. Because we are going to use Cisco ISE for Guest user authentication, I would like to know if there is a way to export these accounts and import them into Cisco ISE.
Thanks in advance.
Joana.

Ok, thanks for your response.
Joana.

AAA Command Authorization

I have an ACS 4.0 device. In the shell command authorization set section, you have the ability to define permitted or denied commands (show) and arguments (running-config). I am limiting users to a specific set of commands. One of the commands is 'exit'. To my knowledge, 'exit' does not have any arguments. If I add 'exit' as a permitted command but enter nothing for the argument section, I get authorization failed at the router. If I select 'permit unmatched args' (for exit), authorization is successful. I would prefer to not select 'permit unmatched args'. Is there an argument for 'exit' that I am not aware of?

It worked thanks. The ACS servers gives me an error saying the correct format is permit or deny followed by an argument, but the 'permit' has been saved and is working.
Thanks again.

ISG issue on AAA prepaid authorization

Hello,
I'm currently working on a FTTH project and I configured a 7204VXR (NPE-G1) along with a 12.2(31)SB2 version of IOS, in order to use Cisco ISG functionnalities. My cisco config file is in attachment.
We have the following architecture:

up

AAA Local Authorization....

Similar Messages

Maybe you are looking for