Content

| 9.7 |  | Authentication, Authorization, and Accounting |
| 9.7.8 |  | Configuring AAA authorization |

AAA authorization enables service limits available to a user. When AAA authorization is enabled, the router uses information retrieved from the user's profile, which is located either in the local user database or on the security server, to configure the user's session. Once this is done, the user will be granted access to a requested service only if the information in the user profile allows it.

Cisco IOS version 12.05T software supports eight different options of authorization on a 2600:

- Authentication proxy services – Applies specific security policies on a per-user basis.
- Commands – Applies to the EXEC mode commands a user issues. To enable authorization for specific, individual EXEC commands associated with a specific privilege level, use the command keyword. This allows you to authorize all commands associated with a specified command level from 0 to 15.
- Configuration Commands – Using no aaa authorization config-commands stops the network access server not from attempting configuration command authorization which disables AAA authorization for all global configuration commands.
- EXEC – Applies to the attributes associated with a user EXEC terminal session.
- Network services – Applies to network connections. This can include a PPP, Serial Line Internet Protocol (SLIP), or ARAP connection.
- Reverse Telnet access – Applies to reverse Telnet sessions.
- Configuration – Applies to downloading configurations from the AAA server.
- ip Mobile – Applies to authorization for IP mobile services.

AAA authorization is configured with the aaa authorization command. When using this command, the type of authorization must be specified. Figure shows some of the keywords used with the aaa authorization command.

Once an authorization type has been specified, define either a default method list or a named method list. Named method lists must be applied to a specific interface before any of the defined authorization methods will be performed. The default method list is automatically applied to all lines and interfaces if no other method list is defined.

Authorization methods and their IOS keywords are listed in Figure .

Before configuring AAA authorization, first perform the following tasks:

- Enable AAA using the aaa new-model command.
- Configure AAA authentication. Authorization generally takes place after authentication and relies on authentication to work properly.
- Configure the router as a TACACS+ or RADIUS client, if necessary.
- Configure the local username/password database, if necessary. Using the username command, rights associated with specific users can be defined.

Once TACACS+ and authentication are configured, configure authorization using the following syntax:

> Router(config)#aaa authorization type {default | list-name} [method1 [...[method4]]

The highlighted command in Figure configures authorization for reverse Telnet sessions.

Users attempting to reverse Telnet from the router must be authorized to issue the command first by a TACACS+ server.

Figure presents a sample EXEC authorization configuration. When configured with the highlighted command, the router will contact a TACACS+ server to determine if users are permitted to start an EXEC shell when they log in.

The aaa authorization command is used to control exactly which commands a user is allowed to enter on the router. Users can only enter commands at or beneath their privilege level. All IOS router commands are assigned a privilege level from 0 - 15. By default, there are three privilege levels on the router, as shown in Figure :

- privilege level 1 = non-privileged (prompt is router>), the default level for login.
- privilege level 15 = privileged (prompt is router#), the level after going into enable mode.
- privilege level 0 = includes 5 commands: disable, enable, exit, help, and logout.

When a user logs in to the router EXEC via the console or a VTY, the user can issue any command in privilege level 1 and/or privilege level 0 by default. Once the user authenticates using the enable command and enable password, that user has privilege level 15.

Levels 2-14 are not used in a default configuration, but commands that are normally at level 15 can be moved down to one of those levels and commands that are normally at level 1 can be moved up to one of those levels. Obviously, this security model involves some administration on the router. To determine the privilege level as a logged in user, use the show privilege command.

To determine what commands are available at a particular privilege level for the Cisco IOS Software Release being used, enter a ? at the command line when logged in at that privilege level.

Instead of assigning privilege levels, command authorization can be done if the authentication server supports TACACS+. The RADIUS protocol does not support command authorization.

Which commands belong to which privilege levels can be precisely configured, including manually defined levels. The commands shown in Figure move the snmp-server commands from privilege level 15 (the default) to privilege level 7. The ping command is moved up from privilege level 1 to privilege level 7.

Use the aaa authorization command to grant access to commands by privilege level.

The user who logs in with level 7 privileges can ping and do snmp-server configuration in configuration mode. Other configuration commands are not available.

A user's privilege level can be determined by the security server or the local username/password database. To configure a local user for a specific privilege, use the following command:

> Router(config)#username name privilege level password password

The following example shows the command used to create a user named flannery with a privilege level of 7:

> RTA(config)#username flannery privilege 7 password letmein

When this user logs in, she will only have access to commands in privilege level 7 and below.