[tac_plus] Re: Restricting Cisco 'interface' command

[dterry at dollartree.com]

I have everything setup correctly on the Cisco side.

I have tried your suggestion below and was unable to prevent a user from
configuring interfaces other than Gi and Fa ports. Debugging tacacs
authorization produced no helpful information.

Further suggestions would be appreciative.



                                                                           
             "Schmidt, Daniel"                                             
             <dan.schmidt at upli                                             
             nkdata.com>                                                To 
                                       "john heasley"                      
             10/20/2009 12:26          <heas at shrubbery.net>,               
             PM                        <dterry at dollartree.com>             
                                                                        cc 
                                       <tac_plus at shrubbery.net>            
                                                                   Subject 
                                       RE: [tac_plus] Re: Restricting      
                                       Cisco 'interface' command           
                                                                           
                                                                           
                                                                           
                                                                           
                                                                           
                                                                           




default service = deny
cmd = interface { permit [faFAgiGI].* }

If you're looking for a simpler configuration, look at my authentication
script on tacacs.org.  However, the above should work for your purposes.

-----Original Message-----
From: tac_plus-bounces at shrubbery.net
[mailto:tac_plus-bounces at shrubbery.net] On Behalf Of john heasley
Sent: Tuesday, October 20, 2009 10:10 AM
To: dterry at dollartree.com
Cc: tac_plus at shrubbery.net
Subject: [tac_plus] Re: Restricting Cisco 'interface' command

Tue, Oct 20, 2009 at 10:35:11AM -0400, dterry at dollartree.com:
>
> Hello,
>
>       I am trying to restrict the usage of the 'interface' command
within
> Cisco gear. I would like the users to have access to issue "interface
Gi.*"
> or "interface Fa.*". I do not want them to have the ability to issue
> "interface Te.*". The configuration that I have in place now for this
is:
>
>         cmd = interface {
>                 permit ".*Gi.*"
>                 permit ".*Fa.*"
>                 deny    .*
>         }
>
> Should this work? If not, where's my error?

make sure authorization is configured on the device, else enable tacacs
authorization debugging to find-out why its not matching.
_______________________________________________
tac_plus mailing list
tac_plus at shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/tac_plus