Dell SmartFabric OS10 User Guide Release 10.5.3

Configure authorization

AAA command authorization controls user access to a set of commands assigned to users and is performed after user authentication. When enabled, AAA authorization checks a remote authorization server for each command that a user enters on the switch. If the commands that are entered by the user are configured in the remote server for that user, the remote server authorizes the usage of the command.

By default, the role you configure with the username password role command sets the level of CLI commands that a user can access.

An OS10 switch uses a list of authorization methods and the sequence in which they apply to determine the level of command authorization granted to a user. You can configure authorization methods with the aaa authorization command. By default, OS10 uses only the local authorization method. You can also configure TACACS+ server-based authorization.

The authorization methods in the method list execute in the order you configure them. Re-enter the methods to change the order. The local authorization method remains enabled even if you remove all configured methods in the list using the no aaa authorization command.

• Enable authorization and configure the authorization methods for CLI access in CONFIGURATION mode. Re-enter the command to configure additional authorization methods and CLI access.

  aaa authorization {commands | config-commands | exec-commands} {role user-role}
  {console | default} {[local] [group tacacs+]}

  • commands — Configure authorization for all CLI commands, including all EXEC and configuration commands.
  • config-commands — Configure authorization only for configuration commands.
  • exec-commands — Configure authorization only for EXEC commands.
  • role user-role — Configure command authorization for a user role: sysadmin, secadmin, netadmin, or netoperator.
  • console — Configure authorization for console-entered commands.
  • default — Configure authorization for non-console-entered commands and commands entered in non-console sessions, such as in SSH and VTY.
  • local — Use the local username, password, and role entries configured with the username password role command for command authorization.
  • group tacacs+ — Use the TACACS+ servers configured with the tacacs-server host command for command authorization.

For detailed information about how to configure vendor-specific attributes on a security server, see the respective RADIUS or TACACS+ server documentation.

Examples: AAA authorization

• All commands entered from a console session with the sysadmin user role are authorized using configured TACACS+ servers first, and local user credentials next, if TACACS+ servers are not reachable or configured.

  OS10(config)# aaa authorization commands role sysadmin console group tacacs+ local

• All configuration commands entered from a non-console session with the sysadmin user role are authorized using the configured TACACS+ servers.

  OS10(config)# aaa authorization config-commands role sysadmin default group tacacs+

Remove AAA authorization methods

OS10(config)# no aaa authorization commands role sysadmin console