Administrator Guide

Authentication, Authorization, and Accounting 317
console(admin-profile)#rule 88 permit command “^password .*”
console(admin-profile)#rule 87 permit command “^username .*”
console(admin-profile)#rule 86 permit command “^show user.*"
console(admin-profile)#rule 85 permit command “^radius server
.*”
console(admin-profile)#rule 84 permit command “^tacacs-server
.*”
3 Enter rule number permit mode mode-name commands to allows all
commands in the named mode.
console(admin-profile)#rule 83 permit mode radius-auth-config
console(admin-profile)#rule 82 permit mode radius-acct-config
console(admin-profile)#rule 81 permit mode tacacs-config
console(admin-profile)#exit
4 Assign this profile to a user by configuring the TACACS+ server so that it
sends the following “roles” attribute for the user:
shell:roles=aaa
If it is desired to also permit the user access to network-operator
commands (basically, all the command in User Exec mode), then the
“roles” attribute would be configured as follows:
shell:roles=aaa,network-operator