Cisco PIX 525 Especificaciones descargar pdf (Pagina 495)

30-11

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 30 Managing System Access

Authenticating and Authorizing System Administrators

Configuring TACACS+ Command Authorization

If you enable TACACS+ command authorization, and a user enters a command at the CLI, the security

appliance sends the command and username to the TACACS+ server to determine if the command is

authorized.

When configuring command authorization with a TACACS+ server, do not save your configuration until

you are sure it works the way you want. If you get locked out because of a mistake, you can usually

recover access by restarting the security appliance. If you still get locked out, see the “Recovering from

a Lockout” section on page 30-15.

Be sure that your TACACS+ system is completely stable and reliable. The necessary level of reliability

typically requires that you have a fully redundant TACACS+ server system and fully redundant

connectivity to the security appliance. For example, in your TACACS+ server pool, include one server

connected to interface 1, and another to interface 2. You can also configure local command authorization

as a fallback method if the TACACS+ server is unavailable. In this case, you need to configure local users

and command privilege levels according to the “Configuring Command Authorization” section on

page 30-7.

This section includes the following topics:

• TACACS+ Command Authorization Prerequisites, page 30-11

• Configuring Commands on the TACACS+ Server, page 30-11

• Enabling TACACS+ Command Authorization, page 30-14

TACACS+ Command Authorization Prerequisites

Complete the following tasks as part of your command authorization configuration:

• Configure CLI authentication (see the “Configuring Local Command Authorization” section on

page 30-7).

• Configure enable authentication (see the “Configuring Authentication To Access Privileged EXEC

Mode” section on page 30-5).

Configuring Commands on the TACACS+ Server

You can configure commands on a CiscoSecure Access Control Server (ACS) TACACS+ server as a

shared profile component, for a group, or for individual users. For third-party TACACS+ servers, see

your server documentation for more information about command authorization support.

See the following guidelines for configuring commands on a CiscoSecure ACS TACACS+ server

Version 3.1; many of these guidelines also apply to third-party servers:

• The security appliance sends the commands to be authorized as “shell” commands, so configure the

commands on the TACACS+ server as shell commands.

Note The Cisco Secure ACS server might include a command type called “pix-shell.” Do not use this

type for security appliance command authorization.

• The first word of the command is considered to be the main command. All additional words are

considered to be arguments, which need to be preceded by permit or deny.

For example, to allow the show running-configuration aaa-server command, add show

running-configuration to the command box, and type permit aaa-server in the arguments box.

1 2 ... 490 491 492 493 494 495 496 497 498 499 500 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 495

Comentarios a estos manuales