0

Is there a way, to create such privilege, which will let to configure just one particular port ex: gi1/0/1 , but at that time will not let to configure gi1/0/2 .

Smth like: privilege interface gi1/0/1 10

UPD: As radius said, from /usr/local/share/doc/tac_plus/users_guide :

    The following configuration example permits user Fred to run the
following commands:

    telnet 131.108.13.<any number> and
    telnet 128.<any number>.12.3 and
    show <anything>

All other commands are denied (by default).

user=fred {

    cmd = telnet {
        # permit specified telnets
        permit 131\.108\.13\.[0-9]+
        permit 128\.[0-9]+\.12\.3
    }
    cmd = show {
        # permit show commands
        permit .*
    }
}
0

2 Answers 2

2

You can use a TACAS+ server to do this using authorization, see http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_cfg_authorizatn.html#wp1001170

4

No, IOS's permissions are not this granular unfortunately.

5
  • And AAA server wont help?
    – TiFFolk
    Sep 25, 2009 at 15:29
  • You could try the link @radius posted. I believe that's referring to telnet access to particular ports however, rather than config access. As I understand it, you need access to global configuration mode to enter interface configuration mode, and by it's nature, global configuration mode is global. I'd be glad for someone to prove me wrong though :-)
    – Cian
    Sep 25, 2009 at 16:39
  • i can limit command "conf" cmd = configure { permit .* } May be the same works like: cmd = interface gigabitEthernet 1/0/1 { permit .* }
    – TiFFolk
    Sep 25, 2009 at 17:09
  • Try it and see :-)
    – Cian
    Sep 25, 2009 at 19:23
  • @Cian with TACACS+ you can restrict access as you want, a user can be only able to change speed on only one interface if you want.
    – radius
    Sep 28, 2009 at 14:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .