<div dir="ltr"><div dir="ltr"><div>> I don't receive Command Authorization commands (confirmed with logs /
pcap) for commands prefaced with 'no', but do for other configuration
level commands.</div><div><br></div><div>Sry I'm late to the party - Have you opened a tac case? Extreme will try to disagree, but <b>that is no small security vulnerability</b>. Have you (and this shouldn't work) tried authorization on the other levels (4 and 5) to see if they help? Your only other option is to try brocade-privlvl = 4 which doesn't give many configuration rights:<br></div><div>#conf t<br>(config)#?<br> cls Clear screen<br> end End Configuration level and go to Privileged<br> level<br> exit Exit current level<br> global-port-security Global-level Port Security configuration<br> interface Port commands<br> mac-authentication Configure MAC authentication<br> no Undo/disable commands<br> quit Exit to User level<br> show Display system information<br> <cr><br><br></div><div>Or maybe try radius as you have hinted to and which I have never had a need to do. If it were Cisco, you could define a new privilege level - not sure about Brocade. <br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Mar 15, 2019 at 2:00 PM Patrick Ohearn via foundry-nsp <<a href="mailto:foundry-nsp@puck.nether.net">foundry-nsp@puck.nether.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Hi List,</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Has anyone got AAA command authorization working correctly on modern Netiron code, on the MLX/CER's?</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">With a working TACACS+ server, with the below aaa configuration, I don't receive Command Authorization commands (confirmed with logs / pcap) for commands prefaced with 'no', but do for other configuration level commands.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">This presents a problem when I can block commands like 'router mpls', but other commands such as 'no router mpls' still work.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Testing is done with a logged in user with priv level 0 (super user). Testing has been done with a few varents of 5.8, 6.0 and 6.2 code all with the same results.<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">Has anyone else ran into this issue? Or has working command authorization with a different (eg; radius) setup?<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">AAA config:</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">tacacs-server host 192.0.2.200<br>tacacs-server key tacacskeyhere<br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif">aaa authentication enable default tacacs+ <br>aaa authentication login default tacacs+ <br>aaa authentication login privilege-mode<br>aaa authorization commands 0 default tacacs+ <br>aaa authorization exec default tacacs+ <br>aaa accounting commands 0 default start-stop tacacs+ <br>aaa accounting exec default start-stop tacacs+ <br>aaa accounting system default start-stop tacacs+ <br><br></div><br>-- <br><div dir="ltr" class="gmail-m_-7497968043499324651gmail_signature">Email: <a href="mailto:pat@ge3k.net" target="_blank">pat@ge3k.net</a></div></div></div></div></div>
_______________________________________________<br>
foundry-nsp mailing list<br>
<a href="mailto:foundry-nsp@puck.nether.net" target="_blank">foundry-nsp@puck.nether.net</a><br>
<a href="http://puck.nether.net/mailman/listinfo/foundry-nsp" rel="noreferrer" target="_blank">http://puck.nether.net/mailman/listinfo/foundry-nsp</a><br>
</blockquote></div>
<br>
<br>E-Mail to and from me, in connection with the transaction <br>of public business, is subject to the Wyoming Public Records <br>Act and may be disclosed to third parties.<br>