[tac_plus] Re: Restricting Cisco 'interface' command

[Schmidt, Daniel]

default service = deny
cmd = interface { permit [fFgG].* }

If you're looking for a simpler configuration, look at my authentication
script on tacacs.org.  However, the above should work for your purposes.

-----Original Message-----
From: tac_plus-bounces at shrubbery.net
[mailto:tac_plus-bounces at shrubbery.net] On Behalf Of john heasley
Sent: Tuesday, October 20, 2009 10:10 AM
To: dterry at dollartree.com
Cc: tac_plus at shrubbery.net
Subject: [tac_plus] Re: Restricting Cisco 'interface' command

Tue, Oct 20, 2009 at 10:35:11AM -0400, dterry at dollartree.com:
> 
> Hello,
> 
>       I am trying to restrict the usage of the 'interface' command
within
> Cisco gear. I would like the users to have access to issue "interface
Gi.*"
> or "interface Fa.*". I do not want them to have the ability to issue
> "interface Te.*". The configuration that I have in place now for this
is:
> 
>         cmd = interface {
>                 permit ".*Gi.*"
>                 permit ".*Fa.*"
>                 deny    .*
>         }
> 
> Should this work? If not, where's my error?

make sure authorization is configured on the device, else enable tacacs
authorization debugging to find-out why its not matching.
_______________________________________________
tac_plus mailing list
tac_plus at shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/tac_plus