Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently deploying TACACS+ with a Cisco device, I use a TACACS server from here:

My scenario is: I want to permit a user to configure my router but only for a specific interface, i.e to gigabitethernet0/0. After arriving at the router(config-if)# that user can do whatever he wants with that interface, but he cannot change to another interface nor change the configuration in the router(config)# .
So far my configuration in tac_plus.conf is like this:

#limited admin group = limitedadmin {
default service = deny
service = shell {
priv-lvl = 15
cmd = configure {
permit terminal
cmd = interface {
permit "GigabitEthernet 0/0"

And this is the Cisco config:

aaa new-model
aaa authentication login default group tacacs+ local
aaa authentication login telnet group tacacs+ local
aaa authentication login lokal local enable
aaa authorization config-commands
aaa authorization exec default group tacacs+ local 
aaa authorization exec telnet group tacacs+ 
aaa authorization commands 1 default group tacacs+ local 
aaa authorization commands 15 default group tacacs+ local 
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+

But with this, I cannot specifically permit that user at config-if without allowing him to configure at router(config) too.

Is my scenario possible using TACACS+ ?

share|improve this question
up vote 0 down vote accepted

Im sure there is relam for this but what can i remember from my days as nw guy that priveleges are based upon command sensitvity not port wise. What command is executed is where you define control It make sense as where user x an configure interface ip or speed and do the same for 100 interfaces its the same trust level.

As for config-if works in inheritence fashion it automatically inherets all privelegs for config level.

 default service = deny
 cmd = interface { permit [faFAgiGI].* }

This would make users to have access to issue "interface Gi." or "interface Fa.". I do not want them to have the ability to issue "interface Te.*".

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.