Cisco IOS Cookbook, 2nd Edition

Restricting Command Access

Problem

You want to restrict permission so that specific users can use only certain commands.

Solution

You can enable TACACS+ command authorization in newer IOS versions with the following set of configuration commands:

Router1#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router1(config)#aaa new-model
Router1(config)#aaa authorization exec default group tacacs+ 
Router1(config)#aaa authorization commands 15 default group tacacs+ 
Router1(config)#tacacs-server host 172.25.1.1
Router1(config)#tacacs-server key COOKBOOK
Router1(config)#end
Router1#

In any IOS version before 12.0(5)T, the AAA syntax was slightly different:

Router2#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.
Router2(config)#aaa new-model
Router2(config)#aaa authorization exec default tacacs+ 
Router2(config)#aaa authorization commands 15 default tacacs+ 
Router2(config)#end
Router2#

Discussion

After you configure AAA authorization, the router will query the TACACS+ server each time somebody enters a command to see if it is allowed. If the user is permitted to use this particular command, the TACACS+ server will respond with an “accept” message, and the router will proceed to execute the command. However, if the user is not permitted to issue the command, the TACACS+ server responds with a “reject” message, and the router will not execute the command. The router also shows a rejection status message on the screen:

Router1#configure ...