Authorization
This scenario shows how to set up per-command authorization.
Tacacs Method Privileged User
Description
A TACACS+ server configured to deny the show date
command and allow everything else is added to a TACACS+ group, which
is added to an AAA list. This list is assigned to CLI’s command
authorization. Whenever a user attempts to run a command, this is sent
to the server and is only executed when authorized to do so.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set system aaa group tacacs tacgroup1 server serv1 set system aaa list list1 method 1 group tacacs tacgroup1 set system aaa server tacacs serv1 address 10.215.168.1 set system aaa server tacacs serv1 encrypted-key U2FsdGVkX19lC+i0PoRtcbxq8WRKUe90MWwb4tURWrg= set system cli aaa authorization list1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system login user testadmin authentication encrypted-password '$6$I0ESV9.xGlxTsllr$JXHF/JtiokmY2tEr.62XO0K3JTfYQRqWHvAbNj4wqqJTWWmlndf6sO6ri9ldYp5AentrZ0I6yuohZQ2MIK.fD0' set system login user testadmin role admin
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.251 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.251/0.251/0.251/0.000 ms
Step 3: Run the command show version on DUT0 and expect the following output:
Show output
OS vendor: Teldat OS name: OSDx OS version: v4.2.10.0 OS Linux kernel: 6.12.74 OS built by: jenkins@diana OS build date: Tue May 12 07:05:13 UTC 2026 OS installation: physical OS boot mode: user License: VM_BASE Firewall eth-Rate-Permit-Full Hardware vendor: QEMU Hardware model: VM Hardware OEM model: Standard PC (i440FX + PIIX, 1996) Hardware version: pc-i440fx-7.2 Hardware UUID: b23ef8f4-8054-57ac-8b07-23538873b460 Hardware architecture: amd64 Hardware fwid: iso Hardware base MAC: de:ad:be:ef:6c:00 Hardware cpu: 1 x QEMU Virtual CPU version 2.5+ (4 cores) Last reboot reason: Power Failure Date: Tue 19 May 2026 16:11:45 +00:00 Uptime: 4:02:58 CPU load (1m, 5m, 15m): 0.13 0.16 0.12 CPU usage % (1m): 3.77 Storage usage (kB): 420052/8144384 Memory usage (kB): 450032/1572532 Users logged in: 1 Mode (current/next boot): user/user Hostname: osdx
Step 4: Run the command show date on DUT0 and expect the following output:
Show output
CLI Error: Unauthorized
Note
Commands are expanded before being sent to the authorization server
Step 5: Run the command sh da on DUT0 and expect the following output:
Show output
CLI Error: Unauthorized
Step 6: Run the command show running on DUT0 and expect the following output:
Show output
# Teldat OSDx VM version v4.2.10.0 # Tue 19 May 2026 16:11:45 +00:00 # Warning: Configuration has not been saved set interfaces ethernet eth0 address 10.215.168.64/24 set system aaa group tacacs tacgroup1 server serv1 set system aaa list list1 method 1 group tacacs tacgroup1 set system aaa server tacacs serv1 address 10.215.168.1 set system aaa server tacacs serv1 encrypted-key U2FsdGVkX19lC+i0PoRtcbxq8WRKUe90MWwb4tURWrg= set system cli aaa authorization list1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system login user testadmin authentication encrypted-password '$6$I0ESV9.xGlxTsllr$JXHF/JtiokmY2tEr.62XO0K3JTfYQRqWHvAbNj4wqqJTWWmlndf6sO6ri9ldYp5AentrZ0I6yuohZQ2MIK.fD0' set system login user testadmin role admin
Tacacs Method Non-Privileged User
Description
In this case, the same scenario is tested but with a non-privileged user called testmonitor.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set system aaa group tacacs tacgroup1 server serv1 set system aaa list list1 method 1 group tacacs tacgroup1 set system aaa server tacacs serv1 address 10.215.168.1 set system aaa server tacacs serv1 encrypted-key U2FsdGVkX18n1d1yjnWv5pxVgA9Pe+UT/tY7q00jHwA= set system cli aaa authorization list1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system login user testmonitor authentication encrypted-password '$6$/U7kp4KFFglsg0Nq$4AHn/viKdyPf8o5aN9kwuLdCoCobt3Dxq5J8lBvHl/RfmFl.PirYJsFH7XR6ThFH17gjjwckGoqRRxfDn.gh90' set system login user testmonitor role monitor
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.339 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.339/0.339/0.339/0.000 ms
Step 3: Run the command show version on DUT0 and expect the following output:
Show output
OS vendor: Teldat OS name: OSDx OS version: v4.2.10.0 OS Linux kernel: 6.12.74 OS built by: jenkins@diana OS build date: Tue May 12 07:05:13 UTC 2026 OS installation: physical OS boot mode: user License: VM_BASE Firewall eth-Rate-Permit-Full Hardware vendor: QEMU Hardware model: VM Hardware OEM model: Standard PC (i440FX + PIIX, 1996) Hardware version: pc-i440fx-7.2 Hardware UUID: b23ef8f4-8054-57ac-8b07-23538873b460 Hardware architecture: amd64 Hardware fwid: iso Hardware base MAC: de:ad:be:ef:6c:00 Hardware cpu: 1 x QEMU Virtual CPU version 2.5+ (4 cores) Last reboot reason: Power Failure Date: Tue 19 May 2026 16:11:54 +00:00 Uptime: 4:03:07 CPU load (1m, 5m, 15m): 0.11 0.16 0.12 CPU usage % (1m): 4.66 Storage usage (kB): 420052/8144384 Memory usage (kB): 431160/1572532 Users logged in: 1 Mode (current/next boot): user/user Hostname: osdx
Step 4: Run the command show date on DUT0 and expect the following output:
Show output
CLI Error: Unauthorized
Step 5: Run the command show running on DUT0 and expect the following output:
Show output
CLI Error: Insufficient privileges