Allowing certain commands about event-driven-servers HOT 7 CLOSED

Hi,

sure, you can limit commands in a profile:

profile roAccess {
    script {
        if (service == shell) {
            # message = "commandline=${cmd]" # uncomment that to see the command line
            if (cmd == "") { set priv-lvl = 15 pemit } # permit exec
            if (cmd =~ /^ping /) permit
            if (cmd = /^show run/ permit
            deny
        }
    }
}

Cheers,

Marc

from event-driven-servers.

Great! And how do I fix this? I came across it before when I was editing the config, but I couldn't figure it out

                                if (cmd =~ /
tac_plus-ng.cfg:40: You're using PCRE syntax, but this binary wasn't compiled with PCRE support.
10893: tac_plus-ng.cfg:40: You're using PCRE syntax, but this binary wasn't compiled with PCRE support.
10893: Detected fatal configuration error. Exiting.

from event-driven-servers.

It seems like I fixed an error related to PCRE. Installed additional packages and executed ./configure --with-pcre.
But the way you proposed to limit commands did not work, any commands are executed

from event-driven-servers.

Hi,

if PCRE (v2 will be mandatory soon) support is available (and "tac_plus-ng -v" confirms that) it's likely that your router/switch/whatever configuration lacks authorization directives. You're using the appropriate "aaa authorization command" statements (assuming that this is a Cisco device)?

Cheers,

Marc

from event-driven-servers.

I use the following Cisco settings (maybe I missed something):

!
tacacs server tpng
 address ipv4 x.x.x.x
 key secret
!
aaa group server tacacs+ tpnggp
 server name tpng
!
aaa authentication login default group tpnggp local
aaa authorization exec default group tpnggp local
!

from event-driven-servers.

Hi,

I'd try

aaa authorization commands 15 default group tpnggp if-authenticated

and, eventually,

aaa authorization config-commands

Cheers,

Marc

from event-driven-servers.

It looks like it's working!
I'll figure it out a little better tomorrow.
Thank you very much Mark, you helped me a lot!

from event-driven-servers.