tac_plus-ng users access control

[sea2space]

Hello!

I have Cisco network device.
Need to configure two user profiles:

• full access (all commands)
• read only (show commands)

I take users and groups from AD via mavis.

My config:

    mavis module = groups {
        resolve gids = yes
        resolve gids attribute = TACMEMBER
        groups filter = "(AdminTSPD|testgroup)"
        memberof filter =  "(AdminTSPD|testgroup)"
        }

    group AdminTSPD
    group testgroup

    profile netadmin {
        script {
            if (service == shell) {
                    if (cmd == "") {
                        set priv-lvl = 15
                        permit
                }
            }
        }
    }


    profile readonly {
        script {
            if (service == shell) {
                    if (cmd == "") { set priv-lvl = 15 permit }
                    if (cmd =~ /^show /) permit
                    if (cmd =~ /^exit /) permit
                        deny
                }
            }
        }
        
        
    ruleset {
        rule {
            script {
                if (member == AdminTSPD) { profile = netadmin permit }
                if (member == testgroup) { profile = readonly permit}
            }
        }
    }

Debug when login via ssh to cisco device user in group AdminTSPD (full access, profile netadmin):

2811: 15:53:06.349 1/851599fc: 10.XX.XX.XX looking for user d.pankratiev in MAVIS backend
2811: 15:53:06.492 1/851599fc: 10.XX.XX.XX result for user d.pankratiev is ACK [142 ms]
2811: 15:53:06.492 1/851599fc: 10.XX.XX.XX looking for user d.pankratiev realm default
2811: 15:53:06.492 1/851599fc: 10.XX.XX.XX user lookup succeded
2811: 15:53:06.492 1/851599fc: 10.XX.XX.XX shell login for 'd.pankratiev' from 10.XX.XX.XX on tty1 succeeded (profile=netadmin)

All good i have full access (profile netadmin), all command accepted.

Debug when login via ssh to cisco device in group testgroup (read only, profile readonly):

2643: 15:37:39.599 0/830566b2: 10.XX.XX.XX looking for user test2 in MAVIS backend
2643: 15:37:39.630 0/830566b2: 10.XX.XX.XX result for user test2 is ACK [30 ms]
2643: 15:37:39.630 0/830566b2: 10.XX.XX.XX looking for user test2 realm default
2643: 15:37:39.630 0/830566b2: 10.XX.XX.XX user lookup succeded
2643: 15:37:39.630 0/830566b2: 10.XX.XX.XX shell login for 'test2' from 10.XX.XX.XX on tty1 succeeded (profile=readonly)

You can see that a profile has been applied to user (test2) where only show commands (profile readonly).
But I get full access, all commands are allowed.

What I'm doing wrong?

[MarcJHuber]

Hi,

please check the "aaa authorization commands ..." configured on your router. It's quite likely that that's missing.

Cheers,

Marc

[sea2space]

@MarcJHuber Thx!
Yes, you were right!

I forgot to configure a command on the hardware:
"aaa authorization commands 15 ...."
Which will check the authorization of level 15 commands using the tacacs server

Everything's great now!