Users Guide

350 Authentication, Authorization, and Accounting
console(admin-profile)#rule 95 permit command “^show tacacs
.*”
console(admin-profile)#rule 94 permit command “^aaa .*”
console(admin-profile)#rule 93 permit command “^line .*”
console(admin-profile)#rule 92 permit command “^login .*”
console(admin-profile)#rule 91 permit command “^authorization
.*”
console(admin-profile)#rule 90 permit command “^accounting .*”
console(admin-profile)#rule 89 permit command “^configure .*”
console(admin-profile)#rule 88 permit command “^password .*”
console(admin-profile)#rule 87 permit command “^username .*”
console(admin-profile)#rule 86 permit command “^show user.*"
console(admin-profile)#rule 85 permit command “^radius server
.*”
console(admin-profile)#rule 84 permit command “^tacacs-server
.*”
3 Enter rule number permit mode mode-name commands to allows all
commands in the named mode.
console(admin-profile)#rule 83 permit mode radius-auth-config
console(admin-profile)#rule 82 permit mode radius-acct-config
console(admin-profile)#rule 81 permit mode tacacs-config
console(admin-profile)#exit
4 Assign this profile to a user by configuring the TACACS+ server so that it
sends the following “roles” attribute for the user:
shell:roles=aaa
If it is desired to also permit the user access to network-operator
commands (basically, all the command in User Exec mode), then the
“roles” attribute would be configured as follows:
shell:roles=aaa,network-operator