If you use a console to login to the server, command authorization is disabled. Authorization is available for
both non-console and console sessions. By default, command authorization is disabled for console sessions
even if it is configured for default (non-console) sessions. You must explicitly configure a AAA group for
the console to enable command authorization for console sessions.
Note
By default, context sensitive help and command tab completion show only the commands supported for a
user as defined by the assigned roles. When you enable command authorization, the Cisco NX-OS software
displays all commands in the context sensitive help and in tab completion, regardless of the role assigned to
the user.
Note
Before you begin
Enable .
SUMMARY STEPS
1.
configure terminal
2.
aaa authorization
{
commands
|
config-commands
} {
console
|
default
} {
group group-list
[
local
] |
local
}
3.
(Optional)
show
{
pending
|
pending-diff
}
4.
(Optional)
commit
5.
exit
6.
(Optional)
show aaa authorization
[
all
]
7.
(Optional)
copy running-config startup-config
DETAILED STEPS
Purpose
Command or Action
Enters global configuration mode.
configure terminal
Example:
Step 1
switch# configure terminal
switch(config)#
Configures the command authorization method for specific
roles on a server.
aaa authorization
{
commands
|
config-commands
}
{
console
|
default
} {
group group-list
[
local
] |
local
}
Step 2
Example:
The
commands
keyword configures authorization sources
for all EXEC commands, and the
config-commands
switch(config)# aaa authorization commands
default group TacGroup
keyword configures authorization sources for all
configuration commands.
Per command authorization will disable RBAC for
all
users. Proceed (y/n)?
The
console
keyword configures command authorization
for a console session, and the
default
keyword configures
command authorization for a non-console session.
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
91
Configuring
Configuring Command Authorization on Servers
