Gert Doering wrote:
Now: what happens if the TACACS server is unavailable? The way we
currently run the shop is "there is a local username configured as
fallback if TACACS doesn't respond" - and people know that they get
slapped if they use this user without good reason.
How would command authorization work in that case?
I think it would once again require the mighty hand of the Gert to slap
his underling back into line.
I believe you can create an authorization list locally that simply
permits all commands. Then set that list as the backup to tacacs in the
AAA config. Like you said before, this is the backup plan in case the
world is coming to an end.
I don't do AAA authorization yet but I do use TACACS and I fall back to
a local user for authentication. It's very handy. That userid & passwd
don't stray far from my hands. I wouldn't make it something that's
known to everyone though. It would be a very select list.
Justin
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
