Documentation Tacacs Users User Groups User Group Fields Description

User group configuration example

  group = CiscoManger {
    #### LDAP Groups List #### DistinguishedName ###
    ### CN=tgui_DemoAccess,OU=Groups,OU=TacacsGUI,DC=win2008,DC=g33
    ### cn=Cisco_General,ou=tgui_groups,dc=openldap,dc=tgui
    enable = clear "123123"
    default service = permit
    ###Service cisco_max_15 START###
    service = shell {
      set priv-lvl = 14
      default cmd = permit
      ###CMD Attr no-debug START###
      cmd = no {
        deny /debug.*/
        permit .* # default permit any
        message deny = "No no no!"
      } #END OF CMD Attr no-debug
    } #END OF Cisco Router/Switch Service
    ###Service cisco_max_15 END###
###MANUAL CONFIGURATION START###
# here is manual configuration parameters
# use char # to make comment
###MANUAL CONFIGURATION END###
  } #END OF CiscoManger

Fields Description

Form Label Nametac_plus ParameterDescriptionImport/Variable nameImport/Value
Name
required
groupThe unique group namenamestring
Enable PasswordenableEnable passwordenablestring
Type of storing
enable
N/ASelect how to store enable password:
  • Clear Text
  • MD5
  • MD5 (hashed)
  • Clone Login password
enable_flagOne of (number):
  • 0 - Clear Text
  • 1 - MD5
  • 2 - MD5 (hashed)

ServiceserviceUser can belong to several services. The first matched service will be applied. Service is a part of configuration that give NAS (device) information about authorization settings of a user.N/AN/A
Access Control ListaclaclOne of (number):
  • acl id
  • acl name
Default Service Permitdefault serviceAllow any service request from NAS (device) if checked, else deny all unknown services from NAS (device).default_serviceOne of (number):
0 - Deny
1 - Permit
MessagemessageThe message that will appeared after user log inmessagestring
Access Control / Action For The List BelowN/AThere are two position:
  • Permit ONLY below list (list of device and device group)
  • Permit all EXCEPT list below (list of device and device group)
N/AN/A
Access Control / Device Listserver = permit/denyAllowed or Denied (based on parameter above) device list for that userN/AN/A
Access Control / Device Groupserver = permit/denyAllowed or Denied (based on parameter above) device group list for that userN/AN/A
Manual ConfigurationN/AConfiguration parameters based on Marc Huber manual. It will added after main configurationmanualstring
Valid Fromvalid fromSet lifetime for uservalid_fromdate
Valid Untilvalid untilSet lifetime for uservalid_untildate