Equipment Support > Hardware By Brand > Cisco > [Config] Cisco ACS Shell command authorization sets

aaa authorization config-commands

aaa authorization console

meeeeee@my-server:~$ cat /etc/tac_plus.conf
key = "whateveryoukeyis"
group = admin {
        default service = permit
        service = exec {
                priv-lvl=15
                }
        service = shell {
                priv-lvl=5
                }
        }
#you may need several lines like the ones below for old
#catalysts 1900 that prompt you for an enable password and
#send that to the tacacs server for checking
host = X.X.X.X {
        enable = des "XXXXXXX"
        }
host = X.X.X.X {
        enable = des "XXXXXXX"
        }

acl = LabRegular {
#source IPs of regular user machines
        permit = X.X.X.X
        permit = X.X.X.X
        permit = X.X.X.X
        permit = X.X.X.X
        permit = X.X.X.X
        }
acl = LabControl {
#source IPs of Control machines (like backbone routers, etc...)
        permit = X.X.X.X
        permit = X.X.X.X
        permit = X.X.X.X
        permit = X.X.X.X
        permit = X.X.X.X
        }
group = UsersCmds {
        default service = permit
       cmd = no {
                deny aaa*
                deny tacacs*
                deny "ip tacacs*"
#deny changing routes to your tacacs servers
                deny "ip route X.X*"
                deny "ip route X.X*"
                deny "login authentication*"
#deny changing the admin interface on your routers
                deny "interface XXX*"
                permit .*
                }
        cmd = default {
                deny aaa*
                deny tacacs*
                deny "ip tacacs*"
#deny changing routes to your tacacs servers
                deny "ip route X.X*"
                deny "ip route X.X*"
                deny "login authentication*"
#deny changing the admin interface on your routers
                deny "interface XXX*"
                permit .*
                }
        cmd = access-class {
                permit .*
                }
        cmd = interface {
#deny changing the admin interface on your routers
                deny "XXXXXX*"
                permit .*
                }
        cmd = aaa { deny .* }
        cmd = tacacs-server { deny .* }
        cmd = ip {
                deny tacacs*
#deny changing routes to your tacacs servers
                deny "route X.X.*"
                deny "route X.X.*"
                permit .*
                }
        cmd = login {
                deny authentication*
                permit .*
        }
        cmd = config-register { deny .* }
        cmd = configure { permit "terminal" }
        cmd = copy {
                permit "running-config startup-config"
                permit "startup-config running-config"
                permit "running-config tftp*"
                permit "running-config flash*"
                permit "startup-config tftp*"
                permit "startup-config flash*"
                deny .*config*
                permit .*
                }
        cmd = write {
                deny erase
                permit .*
                }
        cmd = erase { deny .* }
        cmd = enable {
                deny secret*
                permit .*
                }
        }

group = Control_Users {
        member = UsersCmds
        acl = LabControl
        service = exec {
                priv-lvl=15
                }
        service = shell {
                priv-lvl=15
                }
        }
group = Regular_Users {
        member = UsersCmds
        acl = LabRegular
        service = exec {
                priv-lvl=15
                }
        }
group = Visitors {
        acl = LabRegular
        service = exec {
                priv-lvl=1
                }
        }
user = Control {
        login = des "XXXXXXXXXX"
        member = Control_Users
        }
user = user {
        login = des "XXXXXXXXXX"
        member = admin
        }
user = admin {
        login = des "XXXXXXXXXX"
        member = admin
        }
user = cisco {
        login = cleartext cisco
        member = Visitors