Denying sub-commands

Background : I am running SRA4 image on my 7613 router. The router crashes when i give the command "no interface tunnelx"
Soultion Required :
I need to deny a specific command on my router from the config mode : "no interface Tunnel xyz". How can I acheive this?. The user should have privilege to execute "no interface vlan" , "no interface G1/0.1" etc.. I tried doing this but, ACS 4.0 is not looking for the sub-command, for example if i deny no interface tunnel in Shell command set, ACS looks for only two keywords, in this case no and interface....HELP REQUESTED..

Hi,
One thing that I would like to point, looking at the screen shot is that, the commands are case sensitive and they needs to be defined the exactly the way they are available.
But that does not mean that while executing those commands you need to type them as case sensitive. During execution of the command, you can execute then normally.
Taking as example, the doc that you provided, as you can see that you typed command,
no int tu131
and in ACS logs you got following,
service=shell cmd=no interface Tunnel 131
which means that you need to create you shell command authorization as,
no------deny interface Tunnel
rather then,
no------deny interface tunnel
"no------deny interface Tunnel" works in most of the cases, we need not specify the complete syntax. But if its not working, and you can go to more granularity.
About your question, from the attached screen shot, you have following option checked,
"Unmatched Commands : (*) Permit"
This means, where ever you apply this shell command set. *All* the commands will be *allowed*, except from those that you deny.
And it seems that you are being denied both tunnel and interface on the router, the only reason that I can think of this, the shell command authorization set that you have defined is only valid till,
no-----deny interface
"tunnel" is not correct, it should be "Tunnel"
or to be more precise,
no-----deny interface Tunnel [0-9][0-9][0-9]
considering that you can create 999 tunnels, so above wild card will cover 0-999 tunnels.
Let me know if this helps.
Regards,
Prem

Similar Messages

  • FTP Sub Command: Local Error with EasyDMS

    We have been using DMS for several years.  We have a vault setup and are able the checkin files with FTP via SAPGUI with no problems.  Recently we have been looking at EasyDMS.  We have it installed and can login ok.  When we try to drag a file into the windows explorer the popup appears and we can enter the META data.  When the file is checkin via FTP we get FTP Sub Command: Local Error.
    Any suggestions would be appreciated.

    Tom,
    We have encountered the exact same siituation with EasyDMS, we currently have had an OSS call to SAP for 2 weeks that ended up with the developers in Germany and bouncing the issue back to technical support and stating that they have no idea!
    We are also interested in an answer, sorry I can't help you, but you are not alone.

  • CSU Rev 2.3.6(2) - deny key commands in IOS config mode

    I want to deny certain commands to certain users in a group. I have defined the following on the ACS.
    service = shell{
    default cmd=permit
    default attribute=permit
    cmd=configure{
    deny="no ip routing"
    deny="no router isis"
    permit=""
    This logic does not work.
    1. Does CSU support command authorization within config mode?
    2. Any tips?
    Thanx,
    Kenny

    You are not alone with issues related to the e1000e (but all they concluded was that reloading the module makes it work again):
    https://bbs.archlinux.org/viewtopic.php?id=145564
    It seems like this is more your issue:
    http://permalink.gmane.org/gmane.linux. … devel/8932
    But if none of those boot flags work for you, then there's not much you can do, and you'll have to write a script to reload the module each time after initial boot finishes I guess until the module gets fixed.
    Also, power management of the PCIe interface causes the e1000e to shut off after a while as well (lots of people on CentOS noticing this):
    http://serverfault.com/questions/226319 … ie-aspm-do
    So you can use that boot parameter to stop that from happening, if that becomes an issue for you as well.

  • Sub Command as a menu...

    I'd like to write an application that has some menu such as:
    -Send - Via SMS
    - Via MMS
    -Exit
    I built it using Command....
    private Command send=new Command(....)
    private Command exit=new Command(....)
    and i append it ....
    append(send);
    append(exit);
    the problem is...
    1. I 'd like to make some sub menu (like tree), does anyone know how to do that?
    2. Is it possible for me to do that (making sub menu) ?
    Help me please...

    Hello, I'd like to write an application that has some menu such as:
    -Send
    . |-----> Via SMS
    . |----->- Via MMS
    -Exit
    I built it using Command....
    private Command send=new Command(....)
    private Command exit=new Command(....)
    and i append it ....
    append(send);
    append(exit);
    the problem is...
    1. I 'd like to make some sub menu (like tree), does anyone know how to do that?
    2. Is it possible for me to do that (making sub menu) ?
    Help me please...

  • How to deny enable command.

    On our current config we have this...
    Aaa new-model
    Aaa authentication login default group tacacs+ local
    Aaa authorization config-commands
    Aaa authorization exec default group tacacs+ local
    Aaa authorization commands 15 default group tacacs+ if-authenticated
    In tacacs we have each user in a group. Each group calls upon a command authorization set. In the command set we have denied enable, but we are still able to run enable. The other commands that we test work fine. Any suggestions? Are we able to deny enable at all?
    Thank You,
    Andrew

    Hi Andrew,
    Add the following commands on the device:
    aaa authorization commands 0 default group tacacs+ if-authenticated
    aaa authorization commands 1 default group tacacs+ if-authenticated
    Rgds
    somishra

  • How to interactive will sub shell command in java?

    Refer to command ktutil , it will require a sub command, can java interactive with sub command? And how ?

    Refer to command ktutil , it will require a sub command, can java interactive with sub command? And how ?
    When you post in the forums it is YOUR responsibility to provide the info people need to understand and help you with your problem.
    This new thread appears to be related to your other thread:
    https://forums.oracle.com/thread/2608752
    You will get much better help if you tell us, in English, what PROBLEM you are trying to solve. If you just keep referring to bits and pieces of Kerberos utilities people can't really help you.
    What is it you are trying to do?
    What have you tried so far? What issues are you having with what you have tried so far?
    How is Java involved in whatever it is you are trying to do?

  • Which command I can use to exit from a subvi without exiting from labview in run-time?

    Similiar to 'Exit Sub' command in Visual Basic.

    > Similiar to 'Exit Sub' command in Visual Basic.
    There isn't a command to do this. Since LV is a dataflow language, it
    is important that all the data be delivered to the output terminals.
    BASIC is a procedural language, with all sorts of control flow commands
    like this, and if you are using a functional language or a dataflow
    language, you simply focus on getting to the end of the function. If
    you are in a while loop, you terminate the while loop by the value going
    to the conditional terminal. If you are in a For loop and need to exit
    early, perhaps it should have used a while loop. If there is code in a
    normal diagram that you sometimes do not want to execute, it should
    probably go in a case structure.
    The other reply has some good suggesti
    ons in that you probably have a UI
    or a sequence that you want to exit out of. Organizing your code so
    that you are in a button handling state or exiting state will help you
    organize how you think about the transitions between states. On the
    other hand, there lots of examples and user contributed VIs to look at.
    I'd recommend you get comfortable with a few of them since the state
    machine is just one programming tool, just like the loop and case
    statement that it is built from.
    Greg McKaskle

  • Role-based view commands missing from config

    Hi All,
    I set up a 2960G with IOS 12.2(44)SE6 and created a role-based view to be used by our helpdesk.  One of the things they need to do is add rules to a MAC ACL on the switch.  I've successfully created a view for them and can include and exclude most commands, however, when I try to include the "commands mac-enacle include all permit" command, I get no syntax error, and there is no line in my configuration reflecting the change. As it stands, from the helpdesk view (named smco) I can get into mac acl configuration mode, but I can't issue any of the sub commands.
    Any advice would be greatly appreciated.  I tried upgraded to 12.2(55)SE and had the same result.
    The current configuration for the parser view is as follows:
    parser view smco
    secret 5 hashed_pw
    commands configure include mac access-list extended
    commands configure include all mac access-list
    commands configure include mac
    commands exec include configure terminal
    commands exec include configure

    After I issue the command "commands mac-enacl include all permit" there is no line in my startup or running configuration that says: "commands mac-enacl include all permit" or anything that closely resembles that.
    I've tested with multiple local accounts.  After authenticating, I issue the "enable view smco".

  • How to iterate command Links

    Hi,
    My problem is as i want to show the commandlinks based on database records. Thus under each commandlink I have to show the sub command Links which sense like the sub categories. Any help regarding this.
    many thanks ,
    vijaycanaan.

    Iam using the sun 's core jsf tags <h:dataTable>. Here below is my code if u get confused with my code please leave it and give the solution for bindings.
    [u]view page[/u]
    <%@page contentType="text/html"%>
    <%@page pageEncoding="UTF-8"%>
    <%@ taglib uri="http://java.sun.com/jsf/core" prefix="f"%>
    <%@ taglib uri="http://java.sun.com/jsf/html" prefix="h"%>
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
       "http://www.w3.org/TR/html4/loose.dtd">
    <html>
        <f:view>
            <h:form>
                <head>
                    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
                    <title>JSP Page</title>
                </head>
                <body>
                    <h:dataTable
                     binding="#{MultipleDataGrids.data}"
                        value="#{MultipleDataGrids.results}"
                        var="outerItem"
                    >
                        <h:column>
                            <h:commandLink action="#{MultipleDataGrids.action}">
                                <h:outputText value="#{outerItem.catName}" />
                            </h:commandLink>
                            <h:dataTable
                            binding="#{MultipleDataGrids.data2}"
                                value="#{outerItem.subCatList}"
                                var="innerItem"
                            >
                                <h:column> </h:column>
                                <h:column>
                                    <h:commandLink action="#{MultipleDataGrids.action2}">
                                        <h:outputText value="#{innerItem.catName}" />
                                    </h:commandLink>
                                </h:column>
                            </h:dataTable>
                        </h:column>
                    </h:dataTable>       
                </body>
            </h:form>
        </f:view>
    </html>
    [u]Backing Bean[/u]
    * MultipleDataGrids.java
    * Created on May 3, 2007, 5:59 PM
    * To change this template, choose Tools | Template Manager
    * and open the template in the editor.
    package com.gd.util;
    import java.util.List;
    import java.util.ArrayList;
    import java.sql.*;
    import com.gd.Category;
    import javax.faces.component.UIData;
    import javax.faces.context.FacesContext;
    * @author OM SAI
    public class MultipleDataGrids {
        List results;
        UIData data;
        UIData data2;
        public void setData2(UIData data2) {
            this.data2 = data2;
        public UIData getData2() {
            return data2;
        public void setData(UIData data) {
            this.data = data;
        public UIData getData() {
            return data;
        public List getResults() {       
            results=new ArrayList();
            Connection con=new data.DBConnect().init();
            try {
                Statement request=con.createStatement();
                Statement request2=con.createStatement();
                ResultSet rs1,rs2;
                rs1=request.executeQuery("Select * from catalog WHERE parentid='0' order by catalogname");
                while(rs1.next()) {
                    Category temp=new Category();
                    temp.setCatName(rs1.getString("catalogname"));
                    temp.setCatId(rs1.getString("catalogid"));
                    temp.setSubCatList(new ArrayList());
                    rs2=request2.executeQuery("select * from catalog where parentid='"+temp.getCatId()+"' order by catalogname");
                    while (rs2.next()) {
                        Category ntemp=new Category();
                        ntemp.setCatId(rs2.getString("catalogid"));
                        ntemp.setCatName(rs2.getString("catalogname"));
                        temp.getSubCatList().add(ntemp);
                    results.add(temp);
                con.close();
            } catch (Exception e) {
                System.out.println(e);
            return results;
        public MultipleDataGrids() {
        public String action() {
            Category selected = (Category) this.getData().getRowData();
            System.out.println(selected.getCatName());
            FacesContext ctx = FacesContext.getCurrentInstance();
            ctx.getExternalContext().getSessionMap().put("NewsBeanMore", selected);
            return "morenews";
        public String action2() {
            return "morens";
    [u]FacesConfig.xml
    [/u]
      <managed-bean>
        <managed-bean-name>MultipleDataGrids</managed-bean-name>
        <managed-bean-class>com.gd.util.MultipleDataGrids</managed-bean-class>
        <managed-bean-scope>request</managed-bean-scope>
      </managed-bean>

  • Touch event on midlet command

    Hi,
    I am creating application for touch devices for nokia. J2ME provides methods pointerpressed,release and drag on canvas.
    I have generated a canvas in full screen mode having commands. On click of "option" command, another command menu opens, which is having commands like Ok, Back, Next.
    Now to get the event of sub command menu I have to get that which command is clicked.
    My question is how can I get that particular command has been clicked? Application is for N97/Music express (no keyboard support). I just want the way out using touch functionality. keypress event is not at all useful for me.
    Thank you in advance.
    Rajiv

    hi,
    By implementing the Command u can able to avoid the SoftKeys problem which was major concern in developing an application.
    Go through the Command class in API and u will find good Example also.
    it was not possible to include the canvas class in the Form class.
    Lakshman

  • ACS and AAA deny statements

    I have 1 Windows box running ACS and four 7505 routers configured with AAA commands. Authentication is working fine on the routers via the ACS server. Now I need to deny certain commands like "DEBUG" to certain users without taking off their administrative rights. How can I achieve this?

    Hi
    there are many ways to achieve this, but the *correct* and most scalable is to enable command authorisation on your devices.
    In ACS create some groups based on the permissions levels each group should have.
    In the groups enable the shell (exec) service.
    At this point you can either list the denied commands for certains groups right in the group edit page itself.
    Alternatively, you can created Device Command Sets in the share profiles UI. These are more flexible because inside a single group you cap map to different DCSs based on the device being managed (either by device ip or by network device group)
    Its all there in the ACS docs!
    Good luck.

  • Using Sub/Super scripts in JCheckboxes

    So I have a JCheckbox and I want it's label to be "t2 symmetry" except I would like the 2 to be in subscript.
    I understand that many swing components support HTML but even using <HTML><sub>subscript</sub></HTML>doesn't work, I figured it was just because the Jcheckbox doesn't support it since I've seen other posts in this forum regarding using HTML or even just a <sub> command. But as I'm building in my NetBeans Matisse setup those command don't work in JLabels either.
    There HAS to be a way to make subscripts work in Java 6 SE.
    What can I do to make this work?
    Thanks.

    In the future, Swing related questions should be posted in the Swing forum.
    It works fine for me.
    If you need further help then you need to create a "Short, Self Contained, Compilable and Executable, Example Program (SSCCE)",
    see http://homepage1.nifty.com/algafield/sscce.html,
    that demonstrates the incorrect behaviour, because I can't guess exactly what you are doing based on the information provided.
    Don't forget to use the "Code Formatting Tags",
    see http://forum.java.sun.com/help.jspa?sec=formatting,
    so the posted code retains its original formatting.

  • TACACS+ and authorization "conf-t" commands (IOS)

    Hi
    Is it possible to do authorization for IOS commands ("conf-t mode") on the TACACS + service without having to keep strings as "privilege configure level 3 interface" in the cisco running config?
    Authorization for exec mode commands works well but I need the same for the commands of conf-t mode.
    For example tac_plus.conf:
    I need something like this (fictional syntax):
        service = configure {
           cmd = interface { permit FastEthernet .* }
           cmd = switchport { deny access .* }
    it's already works well:
        service = exec {
           priv-lvl = 3
        cmd = ping { permit .* }
        cmd = wrire { deny memory }
    Thank you for any ideas.

    Hi Oleg,
    here,as you said the commands like ping,show or any other commands in privilege level are authorized with tacacs+ server.but if you want to authorize in global configuration mode then you need to give an extra command
    "acs#aaa authorization config-commands"
    now after giving you can give any global configuration commands like
    "acs(config)#interface FastEthernet "
    either you permit or deny.this command gets  authorizes with tacacs+ server.
    -thanks,
    Rajiv

  • ACS Shell Command Authorization Set + restricted Access

    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0in 5.4pt 0in 5.4pt;
    mso-para-margin-top:0in;
    mso-para-margin-right:0in;
    mso-para-margin-bottom:10.0pt;
    mso-para-margin-left:0in;
    line-height:115%;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    Hi  ,
    I have tried to Create a restricted Access  Shell Command Authorization Set on  ACS as told on the Cisco Url
    http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808d9138.shtml
    After I applied the same on a User  Group I found the users on the group have complete access after typing the conf  t  on the equipments . My ultimate aim was restrict the access only at Interface level , Attached is the config details . Could anyone has come across such scenario . Please check my config and   let me know any thing need to be done specially from My Side
    Thanks in Advance
    Regards
    Vineeth

    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0in 5.4pt 0in 5.4pt;
    mso-para-margin-top:0in;
    mso-para-margin-right:0in;
    mso-para-margin-bottom:10.0pt;
    mso-para-margin-left:0in;
    line-height:115%;
    mso-pagination:widow-orphan;
    font-size:11.0pt;
    font-family:"Calibri","sans-serif";
    mso-ascii-font-family:Calibri;
    mso-ascii-theme-font:minor-latin;
    mso-fareast-font-family:"Times New Roman";
    mso-fareast-theme-font:minor-fareast;
    mso-hansi-font-family:Calibri;
    mso-hansi-theme-font:minor-latin;}
    Hi Jatin ,
    first of all Thank you very much . It startted working after aaa authorization config-commands
    here I was trying to achive one  specfic  thing .
    I want to stop  the following commands  on ACS “switchport trunk allowed vlan 103” . I only want allow “add”  after “vlan” and block rest all arguments
    But even after setting the filter on ACS Still we are able to execute the command is there anything like we cannot control the commands after the sub commands
    Also I am attaching the filter list along with this. Could you have look on this and let me know whether I have configured something wrongly. Other than this is there any work around is available to achieve this .
    Thanks and Regards
    Vineeth

  • ACS 5.1 command authorization in config mode

    Hello all,
    I have setup an ACS 5.1 system and a Cisco 3560 as test device. On the ACS system I have defined a user that will have limited access to Cisco CLI commands (privilege 15 through Shell Profile and limited commands through Command Sets). While this is working great for commands run under enable mode (meaning that the authorization denied the commands that I've specified in the Command Sets), it seems that it's not working under configure mode (e.g. I have denied commands like "router ospf" , "router bgp" , but the user can still apply them).
    Before I've search this forum and found 2 posts:
    https://supportforums.cisco.com/thread/2041611
    https://supportforums.cisco.com/message/3057298
    that suggest to have the AAA configured with:
    aaa authorization config-commands
    I already have this command and it still doesn't work. Actually my entire AAA config looks like this:
    aaa new-model
    aaa authentication login default group tacacs+ local
    aaa authentication enable default group tacacs+ enable
    aaa authorization config-commands
    aaa authorization exec default group tacacs+ local
    aaa authorization commands 1 default group tacacs+ local
    aaa authorization commands 15 default group tacacs+ local
    Did I miss something? Do you have any suggestion for me?
    Thank you!
    Calin

    can you run a "debug aaa authorization" to see what happens?

Maybe you are looking for