AAA Question

[gwildfire]

Guys I am trying to configure AAA on a Cisco router. I want to setup a new level (14) to allow all commands with the exception of "Erase and copy" using LOCAL database (not tacacs+) Ciscos way of doing this seems to be allow basic then configure commands you allow. I need it the other way around as this is a massive list of commands!

Thanks in advance

Graham

Visit

http://www.Cisco-Engineer.com

for free Cisco rack access.

CCNA, CCDA, CCNP, CCDP, CCIE R&S (Written), Net+, MCP, NCTS

 

[gwildfire]

or another approach can I make the startup-config read only have it boot a different config file?

Visit

http://www.Cisco-Engineer.com

for free Cisco rack access.

CCNA, CCDA, CCNP, CCDP, CCIE R&S (Written), Net+, MCP, NCTS

 

[chipk]

If you don't want to allow changes to be written, then that kind of precludes any usefulness for the majority of the commands other than "show", does it not? If you can't write or copy, then the only thing it seems like you want admins to do is "show" and a few other commands.

Check your IOS level as well, there is a wildcard for your privilege command in some versions, which could make the task significantly easier:

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122t/122t13/ftprienh.htm

 

[gwildfire]

No not really Chipk, I run an online lab and I want to clean sessions up when they have finished, one thing that often happens is people set passwords and hostnames etc, then even though I ask them no to, probably out of habit or lack or reading issue copy run start. I want to either prevent that aspect or after reload call upon a different config file.

Visit

http://www.Cisco-Engineer.com

for free Cisco rack access.

CCNA, CCDA, CCNP, CCDP, CCIE R&S (Written), Net+, MCP, NCTS

 

[UnaBomber]

can you not tweak the reg setting to boot the config from a tftp server, and keep your clean config there?

Or you could copy and rename you start-up config and the boot that each time:

http://www.cisco.com/en/US/products...erence_chapter09186a00800ca745.html#wp1027545

 

[gwildfire]

yeah I looked at this link, the boot config command doesnt seem to be an option on any of my routers and they are all 12.3 or 12.4. I will try to tweak the config register see if I can get anywehre like that

Visit

http://www.Cisco-Engineer.com

for free Cisco rack access.

CCNA, CCDA, CCNP, CCDP, CCIE R&S (Written), Net+, MCP, NCTS

 

[plshlpme]

i believe you need to use the
service config
command
you can then set in the router where it will take the config from...

 

[gwildfire]

2511(config)#service ?
compress-config Compress the configuration file
config TFTP load config files

hmm, tried this but it wants to use TFTP, I want to load a file saved in flash. Damm this is annoying!

Visit

http://www.Cisco-Engineer.com

for free Cisco rack access.

CCNA, CCDA, CCNP, CCDP, CCIE R&S (Written), Net+, MCP, NCTS

 

[chipk]

Do you use any SNMP tools like SolarWinds? This still assumes that the users don't change the SNMP community string, but that just adds another way for you to recover back to your original config. If for instance, you set a RW community string, you can just push out the desired config after the class is over or whatever. Like I said, though, that still assumes they don't change the snmp community.

Sorry for assuming earlier, I couldn't think of any real world scenario where you'd want to do this, but I see why you do now.