Cisco command authorization

[Alan DeKok]

Stefan Winter wrote:
...
> These two are the ONLY ones. Since it's just about parsing the string content 
> of cisco-avpair at the router side, there is absolutely no technical reason 
> why these two wouldn't go through. The only explanation then is that this is 
> a deliberate step by Cisco to make sure that TACACS+ is "superior" to RADIUS 
> by arbitrarily cutting down functionality. Probably the code in IOS is larger 
> with an exception handling to make sure that it doesn't work.

  Yes.  It's exactly what Cisco wants.

> I must say: I'm pissed. But I hope I could at least clarify this topic.
> 
> My next-best approach to circumvent this would be to define an intermediate 
> privilege level that only has the permission to do the commands in question, 
> and only assign the users in question to that lower priv-level. Scales 
> poorly, but enough for us. Maybe that approach serves some others as well.

  Or, use a tacacs+ to RADIUS gateway.  Or, integrate Tacacs+ support
into FreeRADIUS.  If we had TCP as a transport layer, adding tacacs+
would be relatively easy.  :)

  Alan DeKok.