Administrator Guide

Authentication, Authorization, and Accounting 315
TACACS Authorization
TACACS+ Authorization Example—Direct Login to Privileged Exec Mode
Apply the following configuration to use TACACS+ for authorization, such
that a user can enter Privileged Exec mode directly:
1 Create an exec authorization method list called “tacex” which contains the
method tacacs.
console#config
console(config)#aaa authorization exec “tacex” tacacs
2 Assign the tacex exec authorization method list to be used for users
accessing the switch via Telnet.
console(config)#line telnet
console(config-telnet)#authorization exec tacex
console(config-telnet)#exit
3 Configure the TACACS+ server so that the shell service is enabled and
the priv-lvl attribute is sent when user authorization is performed. For
example:
shell:priv-lvl=15
NOTES:
• If the privilege level is zero (that is, blocked), then authorization will fail and the user will
be denied access to the switch.
• If the privilege level is higher than one, the user will be placed directly in Privileged
Exec mode. Note that all commands in Privileged Exec mode require privilege level 15,
so assigning a user a lower privilege level will be of no value.
• A privilege level greater than 15 is invalid and treated as if privilege level zero had been
supplied.
• The shell service must be enabled on the TACACS+ server. If this service is not enabled,
authorization will fail and the user will be denied access to the switch.
TACACS+ Authorization Example—Administrative Profiles
The switch should use the same configuration as for the previous
authorization example.
The TACACS+ server should be configured such that it will send the “roles”
attribute. For example:
shell:roles=router-admin