TACACS+ with Windows ACS

[North323]

shot in the dark here...

can you give a user only certain commands in TACACS+? then how do i integrate that into ACS and Windows?

anyone...anyone...

 

[burtsbees]

The easy answer is privilege level...15 is root, 1 is show commands only, and then levels in between...

user bla privilege 5 secret blabla.

Burt

 

[brianinms]

You are asking a question that is a mile wide and 3 feet deep. You can create a group and assign privileges to a group and then assign users to said group. Or you can merely configure them on a per user basis and leave them in the default group.

In all honesty its way too much to type, but it is clearly outlined in the configuration guide.

 

[North323]

thats the problem...its not outlined in the config guide. i want to only provide 'show' commands for certain people. the config guide actually is pretty nub. i'll keep at it

 

[brianinms]

Which version of ACS are you running?

 

[North323]

90 trial version 4.2 i think i totally figured it out

i see in ACS where you configure command sets and then realized i didnt have:
aaa authorization config-commands
aaa authorization commands 0 default group tacacs+ local
aaa authorization commands 1 default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local

in my switch...

scrolling down helps!