ACS 5.3 Different password for privilege exec mode

This is what I would like to do for our Core Routers. Not too familiar with ACS, so please excuse me if I don't provide you will all the details.
Right now I have ACS 5.3 which is tide to Active Directory. When a user logs in they use there AD credentials to access the CLI and use that same password to access privileged exec mode.
What I want to do is have users log in using their AD credentials like normal but have a unique password to access privileged exec mode, different for each user.
So far this is what I have done:
1) Created a test user (same as AD user name) in the Internal Identity Store
Password Type: Internal Users
normal password set differently that Enable Password (I think Enable Password will only be relevant)
2) Created a rule under Access Policies > Device Admin - Commands > Identity
- Created Rule with Current Condition Set (TACACS+:Authen-Type match ASCII And (TACACS+:Action match Login AND TACACS+Service match Enable))
- Identity Source: Internal Users
When I enable the rule. I can login with my AD credentials, but when I try to access privilege exec mode the password that I created for the local user (regular and enable) does not work.
Question: Do I need to create a shell profile with Maximum privilege value set to something under 15 for the authorization policy and apply it so it will try and use the internal user's enable password?
Not to familiar with how this works. One of my co-workers said I needed to demote the users in order for my rule to work.

Hey Tushar,
That is our current setup. Right now each user logs in with their AD credentials to get into user exec mode and the same password to get into privileged exec mode. I would like to have a user login with their normal AD credentials to get into user exec mode and a different password (specific to each user, not locally on the device) to login to privileged exec mode. We are doing this for security reasons. Hopefully that clarifys what I'm trying to do.
Thanks

Similar Messages

Disable password for privileged Exec mode via Telnet

I've looked around for an answer for this specific issue but haven't been able to find one yet. Hoping this is easy and someone can point me in the right direction.
When logging into a 2950 switch via Telnet, I'm prompted for a password when attempting to "enable" privileged mode. I want to disable the password requirement for now (home lab, not production). When I initiate the "no enable password" or "no enable secret" command (via a console connection), and try to initiate the enable command, I receive the message "% No password set". If I now attempt to enable privileged mode from the console, I'm not asked for a password. How can I disable the password prompt for VTY mode?
Thanks!

Thanks for the suggestion; I've tried it but am still asked for a password.
From global config, I entered:
line vty 0 15
privilege level 15
exit
Am I missing any steps there?
Thanks!

Can you have different passwords for mail account and ICloud?

Can you have different passwords for mail account and ICloud?

Yes - you want to go under Notifications, Mail. Set each acct the way you want.

I have only one ID, but I have different passwords for my iPhone and iPad. How to fix that?

I have only one ID, but I have different passwords for my iPhone and iPad. How to fix that?

Hi Cristigil,
Are you talking about your lock screen passcode? If so, go into Settings>General>Passcode Lock, and Change one of your Passcodes to match the other.
Hope this helps!
Cheers,
GB

Different passwords for KeyStore and Key entry

I am having trouble using a keystore whose entries have passwords that are different from both each other, and the keystore itself. I have managed to get this (differing storepass, and keypass) working for the case of a single entry, but this case is pointless since it is the same as having a new keystore for each user. It also works fine in the case that multiple key entries share a password that is different from the keystore. However, when I place a new key entry with a different password into the keystore I get an UnrecoverableKeyException upon initialization of the KeyManagerFactory.
There seems to be some sort of restriction that the key entries should all share the same password.
I have found several articles and texts that touch on this, but the details are fuzzy. Has anyone else ever tried to do this? Will you offer some insight? When multiple users have access to the same machine should they share a keystore, or is keeping a separate keystore file for each user the standard?
Thank you for any assistance.

Pankaj,
Thank you for your reply. I also have not seen the problems when manipulating the keys with keytool. However, when selecting a key through the KeyManager I get problems.
I have wrapped the default KeyManager with another KeyManager which captures the calls to chooseClientAlias, and getPrivateKey so that I may use the key's password rather than the one that was used to load the keystore. The problem seems to arise before this.
I get an UnrecoverableKeyException at the time that the KeyManagerFactory is initialized. I don't know what the KeyManagerFactory initialization method is doing with the password. Do you know where I might find the code for this? My debugger just gives me function defs. I think that I need to supply a custom KMF, but it would be nice to know what the default one is doing first.
I noticed that you have authored a book on j2ee security. Does it cover this?
Ethan

Different password for mail

Can I have a different password to read my mails online?
It seems a little bit tricky to use the same password to read my mails and to purchase all my music/apps.
Thx

https://iforgot.apple.com/password/verify/appleid
if you forgot - reset it and if you can't contact Apple for help.

HT204053 I have a small older iPod with one email address and passcode, & I have created an "Apple ID" yesterday with a different email address & different password, for my new iPOD Touch5: Does that ID & pw now apply to my iTunes?

Does creating a new Apple ID with user name, email and password ( for my new iPod Touch 5 CHANGE and my existing iTunes account username and pw ?
Thanks....Gary
[email protected]

Your new iPod Touch will use what ever ID you specify in Settings>iTunes & App Stores when you purchase apps and media from the iTunes and App stores, regardless of the ID you may have been using before on your older device.

How to assign different passwords for different resource accounts

Hi everyone,
We have a situation where we have users with two resource accounts. They have different passwords with different lengths.We are using Flat file active Sync adapter to create users in both resources and there we are setting passwor.password field. But we need to set different passwords to every resource account and it is obviosly it can not be done with password.password field. We tried e password view before provisioning where we chekout the user and set the follwing parameters:
<set name='userview.resourceAccounts.selectAll'>
<s>false</s>
</set>
<set name='userview.resourceAccounts.currentResourceAccounts[RES1].selected'>
<s>true</s>
</set>
<set name='userview.resourceAccounts.password'>
<ref>accountId</ref>
</set>
<set name='userview.resourceAccounts.confirmPassword'>
<ref>accountId</ref>
</set>
But it did not worked. So is there a way to set different passwords to different accounts in SUN IDM?
Oh and forgot to mention we are using Sun Idm 8.1 patch 9.
Best regards.

I actually managed to change the required password but i copied this in Provision externeal Resources.
<Action id='1' name='Check out password view' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='checkoutView'/>
<Argument name='type' value='Password'/>
<Argument name='id' value='$(accountId)'/>
<Argument name='authorized' value='true'/>
<Argument name='subject' value='Configurator'/>
<Argument name='TargetResources'>
<List>
<String>RES1</String>
</List>
</Argument>
<Return from='view' to='userview'/>
</Action>
<Action id='2' name='reset password'>
<expression>
<block name='reset password' trace='true'>
<set name='userview.resourceAccounts.selectAll'>
<s>false</s>
</set>
<set name='userview.resourceAccounts.currentResourceAccounts[RES1].selected'>
<s>true</s>
</set>
<set name='userview.resourceAccounts.password'>
<ref>accountId</ref>
</set>
<set name='userview.resourceAccounts.confirmPassword'>
<ref>accountId</ref>
</set>
</block>
</expression>
</Action>
<Action id='3' name='check in password view' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='checkinView'/>
<Argument name='view' value='$(userview)'/>
<Argument name='authorized' value='true'/>
<Argument name='subject' value='Configurator'/>
</Action>

HT5616 Do I have to have a different password for each app?

Hi, Do I need a seperate password for each app on my iPod Touch?

Try resetting your password
How do I change or recover a forgotten Apple ID Password?
If you've forgotten your Apple ID Password or want to change it, go to My Apple ID and follow the instructions. SeeChanging your Apple ID password if you'd like more information.
Also, unless you created the ID by:
Creating Apple ID without credit card: Apple Support Communities
You need a valid payment method even for free apps.

Different passwords for different share points on 1 server?

On a lion server I have two share points.
A 'general' is accessible for all users, a 'confidential' is for a select group of users.
The permissions are set and the select group have their server access password in their key chain.
The server password is stored in a separate key chain ie. not in the login key chain.
The select users connect to the server and allways mount the 'general' share point.
The 'confidential' share point is mounted only when needed and unmounted afterward.
Problem is when the users walk away from their computer and forget to lock the computer or to completely disconnect from the server, which is generally very inconvenient because of open documents.
"Unmounting" the confidential share in my setup is not really putting it away securely because at that moment, anyone can sit down at that computer and mount 'confidential' because the login credentials were already given when mounting 'general'.
Is there any way, lest having Parallels running another Lion server that shares the 'confidential' mount point, to force users to enter a password before 'confidential' can be mounted WHILE 'general' IS ALREADY MOUNTED?
In other words, can credential exchange be tied to share point mounting time rather than to server connection time and thus be different for different shares and allow for share-specific unmounting, effectively locking it away?

Has nobody done this before?

Can 2 users have the same email login with different passwords for seperate itunes accounts

My daughter is currently using the home email address for her account and i have just purchased an ipad. I would like a seperate account. Is it possible to use the same email address as the login and have two accounts.
Thanks
Tracey (a mum who is trying to catch up with technology)

It is possible to have two different Apple ID accounts and have a common contact email address, if that is what you are asking. The potential problem is that the Apple ID is in the form of an email address so it can cause some confusion. It would probably be best to actually own the email addresses that match the account IDs.

Do I need a different password for installation of Creative Cloud?

I have just purchased Creative Cloud and downloaded the installer. When it ask for name and password I insert same name and pw used for purchase, this is my Adobe ID, but it is not being accepted. What else could it be looking for?

Aquenew1 it is likely you are being asked for your administrator password to complete the installation process. You can find more details at Install and update apps - https://helpx.adobe.com/creative-cloud/help/install-apps.html.

I am unable to sign into icloud. When asked for my date of birth I receive a message that my dob does match Apple's records. I don't remember setting a different password for icloud.

Since I replaced my iPhone 4 with the 5s I have been unable to access icloud. When asked for my password I receive the message that it is not valid. wehn using the security questions the system does recognize my date of birth.

You can have the password reset sent to the email address associated with your ID, as explained in the second option here: http://support.apple.com/kb/HT5787. If you don't have access to the email address, you'll have to contact Apple for assistance by going to https://expresslane.apple.com, then click More Products and Services>Apple ID>Other Apple ID Topics>Lost or forgotten Apple ID password, or by contacting the Apple account security team: http://support.apple.com/kb/HT5699.

Do I have a different password for security than my login?

I am trying to remove the security on a document but it asks me for my password. I have typed my login password several times carefully and it keeps telling me it is wrong. I even changed my password to be sure, but no luck.

The password is per document, it has nothing to do with your login (unless you used your login password to secure a document). If someone else secured a document you cannot remove security. The person who secured it needs to give you the password. A PDF file may have two passwords: one to open this PDF ("Open" password) and one to change/remove permissions ("Permissions" password). A PDf may have either one or the other or both. You need the "Permissions" password.

Unable to enter to user Privilege EXEC Mode with catalyst 1900

Hello
I am setting up some lab network . I have 10 Cisco 1900 series switches . But when i try to power up it shows the below message. I am not able to get into user privilege mode.
Catalyst 1900 Management Console
Copyright (c) Cisco Systems, Inc. 1993-1997
All rights reserved.
Ethernet address: 00-C0-1D-81-43-65
1 user(s) now active on Management Console.
Enter password:
Catalyst 1900 - Main Menu
     [C] Console Password
     [S] System
     [N] Network Management
     [P] Port Configuration
     [A] Port Addressing
     [D] Port Statistics Detail
     [M] Monitoring
     [V] Virtual LAN
     [R] Multicast Registration
     [F] Firmware
     [I] RS-232 Interface
     [U] Usage Summaries
     [H] Help
     [X] Exit Management Console
Enter Selection:
could you pls tell me how can i get into the user mode such as
Switch1#
Thanks
Navaz

There were two versions of software for the 1900 series switches, one that purely menu based configuration and management and the Enterprise version, which had an option to exit the menu and get access to a CLI. Note though that this is not Cisco IOS.
There's a post, Catalyst 1900 Enterprise software, on the forum from 2002 that will give you some more details. As indicated in that post there's an option to upgrade to the Enterprise edition, but you obviously need to acquire the software.
As per the reponses from Richard and Leo, these are very old switches and depending upon what you're trying to do with them, may not serve your purpose.
Regards

ACS 5.3 Different password for privilege exec mode

Similar Messages

Maybe you are looking for