Users Guide

Configure authorization
AAA command authorization controls user access to a set of commands assigned to users and is performed after user
authentication. When enabled, AAA authorization checks a remote authorization server for each command that a user enters on
the switch. If the commands that are entered by the user are configured in the remote server for that user, the remote server
authorizes the usage of the command.
By default, the role you configure with the username password role command sets the level of CLI commands that a user
can access.
An OS10 switch uses a list of authorization methods and the sequence in which they apply to determine the level of command
authorization granted to a user. You can configure authorization methods with the aaa authorization command. By
default, OS10 uses only the local authorization method. You can also configure TACACS+ server-based authorization.
The authorization methods in the method list execute in the order you configure them. Re-enter the methods to change the
order. The local authorization method remains enabled even if you remove all configured methods in the list using the no aaa
authorization command.
● Enable authorization and configure the authorization methods for CLI access in CONFIGURATION mode. Re-enter the
command to configure additional authorization methods and CLI access.
aaa authorization {commands | config-commands | exec-commands} {role user-role}
{console | default} {[local] [group tacacs+]}
○ commands — Configure authorization for all CLI commands, including all EXEC and configuration commands.
○ config-commands — Configure authorization only for configuration commands.
○ exec-commands — Configure authorization only for EXEC commands.
○ role user-role — Configure command authorization for a user role: sysadmin, secadmin, netadmin, or
netoperator.
○ console — Configure authorization for console-entered commands.
○ default — Configure authorization for non-console-entered commands and commands entered in non-console
sessions, such as in SSH and VTY.
○ local — Use the local username, password, and role entries configured with the username password role
command for command authorization.
○ group tacacs+ — Use the TACACS+ servers configured with the tacacs-server host command for command
authorization.
NOTE:
Custom user roles are supported, but the custom privilege levels are not supported. The default privilege level based
on the user role is assigned.
For detailed information about how to configure vendor-specific attributes on a security server, see the respective RADIUS or
TACACS+ server documentation.
Examples: AAA authorization
● All commands entered from a console session with the sysadmin user role are authorized using configured TACACS+
servers first, and local user credentials next, if TACACS+ servers are not reachable or configured.
OS10(config)# aaa authorization commands role sysadmin console group tacacs+ local
● All configuration commands entered from a non-console session with the sysadmin user role are authorized using the
configured TACACS+ servers.
OS10(config)# aaa authorization config-commands role sysadmin default group tacacs+
Remove AAA authorization methods
OS10(config)# no aaa authorization commands role sysadmin console
Enable AAA accounting
To record information about all user-entered commands, use the AAA accounting feature — not supported for RADIUS
accounting. AAA accounting records login and command information in OS10 sessions on console connections using the
console option and remote connections using the default option, such as Telnet and SSH.
1322
Security