Hello,
I am trying to create some restricted logins to Brocade devices (XMR and CERs)
so that general moves and changes can be performed by operations staff
without routine use of admin access, to prevent any dangerous or
accidental config changes without further checking.
I have added a bunch of privilege re-assignments such as:
privilege interface level 4 sflow
privilege port-vlan level 4 router-interface
privilege port-vlan level 4 untagged
privilege port-vlan level 4 tagged
privilege virtual-interface level 4 port-name
privilege virtual-interface level 4 enable
privilege virtual-interface level 4 disable
privilege virtual-interface level 4 ipv6
privilege virtual-interface level 4 ip
privilege protocol-vlan level 4 router-interface
privilege configure level 4 access-list
...
And this mostly works, however there are some things that do not seem to
work properly, namely:
privilege configure level 4 route-map
The non-admin user is able to create and delete route-maps but then has
no access to be able to modify the level underneath:
s...@router(config)#route-map FOO permit 10
s...@router(config-routemap FOO)#?
cls Clear screen
end End Configuration level and go to Privileged
level
exit Exit current level
no Undo/disable commands
quit Exit to User level
show Display system information
<cr>
s...@router(config-routemap FOO)#
s...@router(config-routemap FOO)#set as-path prepend 9999
Invalid input -> set as-path prepend 9999
Type ? for a list
In this form, it is pretty useless.
It presents another possible danger in that it allows a blank entry to
be inserted into a route-map which cannot be updated, and a blank entry
means "permit all", so this could lead to leaking full tables etc
where this is not wanted!
Is this just broken or am I missing something?
It seems to need a "privilege route-map level ..." option.
Is it solvable using TACACS+ ? I was hoping to avoid having to implement
so that one user can run a few commands, but I suppose it may give
better accounting to have TACACS+
Any thoughts appreciated.
Regards,
Rob
--
Rob Lister
NetSumo Limited
D: +44 (0) 20 7993 1707
S: +44 (0) 20 7993 1700
E: [email protected]
_______________________________________________
foundry-nsp mailing list
[email protected]
http://puck.nether.net/mailman/listinfo/foundry-nsp
