Hi, On Tue, Jul 14, 2009 at 08:40:17PM +0200, Peter Rathlev wrote: > On Tue, 2009-07-14 at 18:05 +0200, Gert Doering wrote: > > Mmmmh. If one does TACACS command authentication, one could > > investigate whether disallowing the "without-add/-delete" form of the > > command via TACACS works... > > It does indeed. We use something similar to the configuration below for > "operators" who can do simple maintenance chores.
Cool.
We're currently not doing TACACS command authorization, but I might
be tempted to introduce that :-)
Now: what happens if the TACACS server is unavailable? The way we
currently run the shop is "there is a local username configured as
fallback if TACACS doesn't respond" - and people know that they get
slapped if they use this user without good reason.
How would command authorization work in that case?
... it's not unheard-of that router configuration is direly needed to
repair a broken network connection *to* the TACACS Server, so this
problem must be known to other folks as well :-)
gert
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]
fax: +49-89-35655025 [email protected]
pgpqCgH7CpOcg.pgp
Description: PGP signature
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
