TACACS protocol
U
SER
G
UIDE
284
Connected Users:
pts/0 admin@IMOLA
You are logged on pts/0
admin@IMOLA>
User with privilege 15 through the command:
set privilege level 5 <command-prefix>
can establish which commands can be executed by users with privilege 5. For example:
set privilege level 5 set adsl
set privilege level 5 set isdn
set privilege level 5 set gprs
It can set the password for accessing to level 5 through the command:
set enable password level 5
The connected user with privilege 3 can execute the command:
enable 5
and can acquire the right to execute the configured command
set adsl, set isdn e set gprs
.
A
CCOUNTING AND AUTHORIZATION
Accesses to the router are controlled by an accounting message sent to the server when there is the
authentication (
Accounting start
), and a message is sent when the session ends (
Accounting
stop
).
The most important parts of the Start message are:
Name of the connected user
Level of privilege assigned
IP address from which the connection has been executed
The Stop message also contains:
The duration of the session
The reason of the logoff
If in Tacacs configuration the following command is set:
set tacacs do-accounting
each command executed during the session will be sent as an Accounting message to Server
TACACS. This message contains the name of the connected user, the computer from which the
connection occurred and the command executed.
In order to disable Accounting functions (Start and Stop messages cannot be disabled) the
command is:
set tacacs no-do-accounting
If in the configuration the following command is set:
set tacacs do-authorization
