Justin Shore wrote:
Gert Doering wrote:
Now: what happens if the TACACS server is unavailable? The way we
currently run the shop is "there is a local username configured as
fallback if TACACS doesn't respond" - and people know that they get
slapped if they use this user without good reason.
How would command authorization work in that case?
I think it would once again require the mighty hand of the Gert to slap
his underling back into line.
I believe you can create an authorization list locally that simply
permits all commands. Then set that list as the backup to tacacs in the
AAA config. Like you said before, this is the backup plan in case the
world is coming to an end.
I don't do AAA authorization yet but I do use TACACS and I fall back to
a local user for authentication. It's very handy. That userid & passwd
don't stray far from my hands. I wouldn't make it something that's
known to everyone though. It would be a very select list.
That might work in some places, and our auditors certainly seem to think
there should only be 1 person with the router enable password (wtf?!)
but we adopted a slightly more low-tech solution. It's not as sexy as
running a TACACS server:
alias interface tagvlan switchport trunk allowed vlan add
alias interface detagvlan switchport trunk allowed vlan remove
...then:
conf t
int g1/1
tagvlan 100,101
detagvlan 200
...and just don't use the more dangerous commands.
I imagine something even more sophisticated could be done with the new
EEM cli commands interface.
Does anyone know if this can be done without TACACS? Using CLI views or
similar?
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
