[a-nsp] Console only local login user or better way to do this?

[Drew Weaver]

Howdy, sure.

This is what I had to add to our config template in our lab device to get it to work how we wanted. (where console users auth via local db and everyone else goes through AAA/tacacs).

aaa authentication login console local <-- this lets the user login via the console using localdb
aaa authentication enable console local <-- this lets the user use the ‘enable’ command via the console

We didn’t want to use ‘enable’ for this but for some reason without the ‘enable’ line no commands would be authorized even though the user itself was created like this:

username console privilege 15 role network-admin ……………………………………………….

I also tried to use “aaa authorization serial-console” instead of using the ‘enable password’ to permit .* (which should’ve been inherited from the user’s role…) but this had an impact that I couldn’t even explain which was causing the user logged in from the console to be immediately logged out from the console. (?)

Anyway I hope this helps.

Thanks,
-Drew






From: arista-nsp <arista-nsp-bounces at puck.nether.net> On Behalf Of Richard Laager via arista-nsp
Sent: Friday, July 10, 2026 3:20 PM
To: arista-nsp at puck.nether.net
Subject: Re: [a-nsp] Console only local login user or better way to do this?

Are you willing to share the additional commands?

On 2026-07-10 13:36, Drew Weaver via arista-nsp wrote:
Nevermind I was able to get this it took a few more commands that weren’t really documented in the example.

Thanks everyone, have a nice weekend and sorry for the noise.




From: arista-nsp <arista-nsp-bounces at puck.nether.net><mailto:arista-nsp-bounces at puck.nether.net> On Behalf Of Drew Weaver via arista-nsp
Sent: Friday, July 10, 2026 2:13 PM
To: 'arista-nsp at puck.nether.net<mailto:arista-nsp at puck.nether.net>' <arista-nsp at puck.nether.net><mailto:arista-nsp at puck.nether.net>
Subject: [a-nsp] Console only local login user or better way to do this?

Hi,

We use tacacs+ and/or SSH keys for regular access to configure infrastructure as is tradition.

We wanted to see if there was a way to configure a local account just for con0 access to the switch.

Not only just in the event that the tacacs+ infrastructure becomes unavailable (I believe our configuration falls back to local anyway)

But sometimes we are making changes to things that it would be really nice to have console access to the switch prior to a potentially breaking change.

I found this article which seems to attempt to describe how to achieve using the local database only for console access which seems like what I want.

https://arista.my.site.com/AristaCommunity/s/article/Configure-Restricted-Local-User-To-Exec-Prompt<https://urldefense.proofpoint.com/v2/url?u=https-3A__arista.my.site.com_AristaCommunity_s_article_Configure-2DRestricted-2DLocal-2DUser-2DTo-2DExec-2DPrompt&d=DwMFAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=OPufM5oSy-PFpzfoijO_w76wskMALE1o4LtA3tMGmuw&m=xUqbUO3OdjxxRL71AuRfquYG7O-1oMZu5KxMM5z1GS2BOudwgbZlj3oUa2RoLk_X&s=MFSDC-exA7_kYPpoOFl1tXng7bcOZPi2k9CDzDNprTw&e=>

However I just cannot seem to get it to work following the example.

Does anyone have a working configuration whereby logins on Con0 will be processed locally?

Thanks in advance.
-Drew







--

Richard
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/arista-nsp/attachments/20260710/f5c5a962/attachment.html>