Based on the roles of the views of CLI with AAA method

Hello

I'm configuration based on the roles of views CLI on a router to limit access to users.

My criteria:

-There should be a local user account on the router that has the view of 'service' in the annex

-If the router is online and can reach the radius server, people in the right group are assigned to the view 'service '.

My configuration:

AAA new-model

Select the secret 1234

username view service secret service 1234

!

AAA my_radius radius server group
private-server 10.1.1.1 auth-port 1645 acct-port 1646 timeout 3 retransmit 2 0 1234 key
private-server 10.1.1.2 auth-port 1645 acct-port 1646 timeout 2 relay 1 0 1234 key

!

authorization AAA console
AAA authentication login my_radius local group mgmt
AAA authorization exec mgmt my_radius local group

!
Line con 0
authorization exec mgmt
Synchronous recording
login authentication mgmt
line vty 0 4
authorization exec mgmt
Synchronous recording
login authentication mgmt
entry ssh transport

THE ERROR

Now, I want to go set up the cli view "service"...

# mode

Password: 1234

* 08:00:02.991 Jun 1: AAA/AUTHENTIC/SEE (0000000 D): method of picking list "mgmt".
* Jun 1 08:00:02.991: RADIUS / ENCODE (0000000D): ask "" password: ".
* Jun 1 08:00:02.991: RADIUS / ENCODE (0000000D): upload the package. GET_PASSWORD
* 08:00:21.011 Jun 1: RADIUS: receipt id 1645/13 10.1.1.1:1645, Access-Reject, len 20

Questions

Why the view "enable" trying to choose a list of method when you need to provide secrecy to enable it to access the root view?

You can change this behavior to always use the key to activate it?

The TEMPORARY Solution

If you are connected to the router via telnet or SSH, the solution or workaround for this problem is:

local VIEW_CONFG AAA authentication login

!

line vty 0 4

authentication of the connection VIEW_CONFG

Make your view configuration and reconfigure the line to use the correct (desired) authentication method.

________________________________

Thanks a lot for the suggestions

/ ENTOMOLOGIST

Hello

You have configured the following:

AAA authentication login my_radius local group mgmt
AAA authorization exec mgmt my_radius local group

Line con 0
authorization exec mgmt
Synchronous recording
login authentication mgmt
line vty 0 4
authorization exec mgmt
Synchronous recording
login authentication mgmt

entry ssh transport

So every time you try to connect to the console or ssh authentication will travel to the server radius because of the following command 'connection authentication mgmt '.

You can get there. What is set on the method list mgmt first will take precedence.

activate seceret is defined locally. but you have configured the following:

AAA authorization exec mgmt my_radius local group

Line con 0
authorization exec mgmt

line vty 0 4
authorization exec mgmt

So exec mode is also via the radius server.

When you set up:

local VIEW_CONFG AAA authentication login

!

line vty 0 4

authentication of the connection VIEW_CONFG

You do local authentication, so it works the way you want.

In short, regardless of authentication is set 1 on the list method will take priority. the relief will be checked only if the 1st aaa server is not accessible.

I hope this helps.

Kind regards

Anisha

P.S.: Please mark this thread as answered if you feel that your query is resolved. Note the useful messages.

Tags: Cisco Security

Similar Questions

  • Interactive report based on the view

    Hello!

    I just started to rewrite my apps of forms at the Apex.
    Based on an existing view, I want to create an interactive report, but there is only the choice between 'Table' and 'SQL statement'.
    Is it possible to use the view directly (not in a SQL ' select * view)?

    Concerning
    Pietja

    Hello Pietja,

    In my APEX env (3.2) an IR cannot be based on a SQL query. You can use the Query Builder to select a table or view, but still he ends with an SQL statement.

    Greetings,
    Roel
    http://roelhartman.blogspot.com/
    You can reward this response in marking it as useful or Correct ;-)

  • Can't access Conversation view under the view menu. With the help of 38.0a1 every day. Any ideas?

    I can access the Conversation view under the view menu in TB version final candidate 31.4.0. But he don't see under daily 38.0a1 of 64-bit version on different computers. Any help appreciated.

    THX

    Ok. Do not take into account. Apparently the conversation view is an Extension to tuberculosis, only not part of the base product. Hope that I would not lose too much of your time. Live and learn.

    Thank you
    Doug

  • Creating folders in the view of data with powercli store

    Hello

    We try to automate some parts of a build script and we want to create a folder in the view of data warehouses to move all the local disk.  the only place that I can create a folder has been the point of view of Cluster, DataCenter and VM.  is there a way to do this?

    Thank you

    Matt

    This is a hidden folder named "datastore".

    You can do

    $dsHome = Get-Folder -Name datastoreNew-Folder -Name MyFolder -Location $dsHome
    

    Note that there is 1 folder "data store" by the data center.

    If you have more than 1 data center in your vCenter, you need to indicate what you want "datastore" folder from the data center.

    $dc = Get-Datacenter -Name DC$dsHome = Get-Folder -Name datastore -Location $dcNew-Folder -Name MyFolder -Location $dsHome
    
  • based on the constraints of layout with group in actionscript

    Hello

    I need a layout based on the constraints in Actionscript, this example works very well:

    <s:Group width="100%" height="100%">
         <s:layout>
              <s:FormItemLayout>
                   <s:constraintRows>
                        <s:ConstraintRow id="row1" />
                        <s:ConstraintRow id="row2"/>
                        <s:ConstraintRow id="row3"/>
                   </s:constraintRows>
              </s:FormItemLayout>
         </s:layout> 
         <s:Label text="row1" bottom="row1:0" />
         <s:Label  text="row2" bottom="row2:0" />
         <s:Label text="row3" bottom="row3:0"/>
              
    </s:Group>
    
    

    but I can't make it work in ActionScrip:

    var group:Group=new Group();
    var form:FormItemLayout=new FormItemLayout();               
    var vec:Vector.<ConstraintRow> = new Vector.<ConstraintRow>();
                   
    var row:ConstraintRow=new ConstraintRow();
    row.id="row1";
    vec.push(row);
                   
    row=new ConstraintRow();
    row.id="row2";
    vec.push(row);
                                                 
    row=new ConstraintRow();
    row.id="row3";
    vec.push(row);
                   
    form.constraintRows=vec;
    group.layout=form;     
                   
    var l:Label=new Label();
    l.text="hello";
    l.bottom="row1:0";
    group.addElement(l);
                   
    l=new Label();
    l.text="hello";
    l.bottom="row2:0";
    group.addElement(l);
                   
    l=new Label();
    l.text="hello";
    l.bottom="row3:0";
    group.addElement(l);
                   
    this.addElement(group); 
    
    


    I don't even see the labels with this code. what I am doing wrong?

    Thank you very much for your help!

    Try to call "row.initialized (this.document,"rowName");" I had problems with ConstraintLayouts created in Actionscript and found that you must manually initialize ConstraintRows and ConstraintColumns to get them to work.

  • SelectOneChoice based on the view object

    Hello

    I have a simple need to create a selectOneChoice based on viewObject.

    If I drag the VO dataControle Panel and drop it into the page as a selectOneChoice, I have something like this

    < af:selectOneChoice value = "#{pageFlowScope.myBean.mySelectedValue} '"

    label = "#{Bindings.myVO.label} '"

    required = "#{bindings. . myVO. hints.mandatory}.

    shortDesc = "#{bindings. . myVO. hints.ToolTip}"id ="soc2">

    < f: selectItems value = "#{bindings. . "{myVO.some}" id = "si4" / >

    < / af:selectOneChoice >

    NB. I manually modified value points to an attribute in the bean

    The problem is that when the user choose a value and submit, the value set in the myBean.mySelectedValue is that the label not display the code (actually I don't know where I can choose which attribute represent the value).

    So, how can I ask to ADF to set the value, and not on his label as the value selected in the selectOneChoice.

    NB. in the case of slectManyChoice, when we drop the VO, the popup displays choose us the attribute which is the base attribute and the screen, but this is not the case for selectOneChoice.

    Thank you

    Elias.

    I now, however, it's the simplest solution possible. You do not have to use the VO itself that you store the selection elsewhere. You can create a VO with a transitional attribute that allows you to create a list of value. This allows you to leave the framework it's magic.

    Timo

  • Images do not open in the Viewer Windows photo with error 0 x 80070000?

    Whenever I try to open my pictures in Windows Photo Viewer, it must always be charged and I end up closing running my patience to the ground. I then change the program to open it in Windows Live Photo Gallery and it comes up with an error of 0 x 80070000, I watched this but can not solve. So for now, I use Microsoft Office 2010 photo viewer and it works fine but I want to use other programs.

    Anyone can solve this help please!

    Hi BrentonFazzolari,

    ·         What is the file format of the image?

    ·         You get this error for all images, you're trying to open?

    ·         How long have you been faced with this problem?

    ·         You did it last changes before the show?

    I suggest you follow the TEPS to solve the problem:

    a. see other photos including the different sizes and different formats and see if the performance is the same.

    (b) as a general rule, this behavior may be caused by prior caching in Windows Live Photo Gallery too.  Precacheing can cause many to use system resources. We will try to disable caching prior to this problem. To do this, proceed as follows.

    Note: changes to the registry can damage unrecoverable, please back up the registry first.

    (a) click Start and type regedit in the box start the search.

    (b) locate and then click the following registry subkey:

    HKEY_CURRENT_USER\Software\Microsoft\Windows Live\ Photo Gallery\Viewer

    (c) click on edit, point to new and then click DWORD (32-bit) value.

    (d) in the new area #1, type CacheSize and press ENTER.

    (e) right click CacheSize and click on modify.

    (f) in the value data box, type 0, and then click OK.

    (g) close the registry editor.

    Please post your question in the forums of Windows Live Photo Gallery to get help.

    Windows Live Photo Gallery Forum

    http://www.windowslivehelp.com/forums.aspx?ProductID=20

    Hope this information helps.

  • allow the launch of the desktop computers only with the view-client CLI commands

    Hello

    It is possible to restrict desktop graphical clients (web and non-web) launch and the launch of single command line interface?

    what I want to achieve this, is to restrict access to desktop computers to view associated with a physical location, while allowing "ALL users" to connect to desktop computers only when you get close to those and not distance.

    Looks like using the Kiosk mode to make the broker, authentication and connection of office and then disable the SINGLE sign-on and have instead users connect manually inside the VM, adapt to your usecase?

  • generate the view in line with the values of the 'sequence' 0.36

    I want my query to join inline view that has values of 0.36, what is the best way to create this inline-view?
    My initial solution would be:
    SELECT LEVEL RESULT FROM Dual CONNECT BY LEVEL < 37
    union
    select 0 from dual
    order by 1
    I want to write the query that returns the same values as this query, I showed.

    CharlesRoos wrote:
    I want my query to join inline view that has values of 0.36, what is the best way to create this inline-view?
    My initial solution would be:

    SELECT LEVEL RESULT FROM Dual CONNECT BY LEVEL < 37
    union
    select 0 from dual
    order by 1
    

    I want to write the query that returns the same values as this query, I showed.

    SELECT (LEVEL - 1) RESULT FROM Dual CONNECT BY LEVEL <= 37 ;
    

    Published by: user503699 on October 29, 2010 14:20

  • Based on the list of components with drag-/ dropEnabled = true can not coexist with other moveable components

    Hello Flexers,

    because I find it a bit difficult to describe the problem I will try that after posting the code and a screenshot:


    <s:Application
         xmlns:fx="http://ns.adobe.com/mxml/2009"
         xmlns:s="library://ns.adobe.com/flex/spark"
         xmlns:mx="library://ns.adobe.com/flex/mx"
         width="100%" height="100%">
        
         <s:layout><s:HorizontalLayout/></s:layout>
        
         <fx:Script>
              <![CDATA[
                   import mx.core.IUIComponent;
                   import mx.core.IVisualElement;
                   import mx.events.DragEvent;
                   import mx.managers.DragManager;
                  
                   protected function draggableLabel_mouseDownHandler(event:MouseEvent):void {
                        DragManager.doDrag(event.currentTarget as IUIComponent,null,event);
                   }
                  
                   protected function leftGroup_dragEnterHandler(event:DragEvent):void {
                        DragManager.acceptDragDrop(event.currentTarget as IUIComponent);
                   }
                  
                  
                   protected function leftGroup_dragDropHandler(event:DragEvent):void {
                        leftGroup.addElement(event.dragInitiator as IVisualElement);
                   }
                  
              ]]>
         </fx:Script>
        
        
         <s:List id="leftList"
              dragEnabled="true"
              dropEnabled="true"
              width="200" height="200">
              <s:ArrayCollection>
                   <fx:String>Item 1</fx:String>
                   <fx:String>Item 2</fx:String>
                   <fx:String>Item 3</fx:String>
              </s:ArrayCollection>
         </s:List>
        
         <s:List id="rightList"
              dragEnabled="true"
              dropEnabled="true"
              width="200" height="200">
              <s:ArrayCollection>
                   <fx:String>Item 4</fx:String>
                   <fx:String>Item 5</fx:String>
                   <fx:String>Item 6</fx:String>
              </s:ArrayCollection>
         </s:List>
        
         <s:Group id="leftGroup"
              dragEnter="leftGroup_dragEnterHandler(event)"
              dragDrop="leftGroup_dragDropHandler(event)"
              width="200" height="200">

              <s:Rect left="0" right="0" bottom="0" top="0">
                   <s:fill><s:SolidColor color="0x00FF00"/></s:fill>
              </s:Rect>

         </s:Group>
        
         <s:Group id="rightGroup"
              width="200" height="200">

              <s:Rect left="0" right="0" bottom="0" top="0">
                   <s:fill><s:SolidColor color="0xFF0000"/></s:fill>
              </s:Rect>

              <s:Label text="DRAG ME"
                             color="0x000000"
                             mouseDown="draggableLabel_mouseDownHandler(event)"
                             y="0"/>
              <s:Label text="DRAG ME"
                             color="0x000000"
                             mouseDown="draggableLabel_mouseDownHandler(event)"
                             y="40"/>
              <s:Label text="DRAG ME"
                             color="0x000000"
                             mouseDown="draggableLabel_mouseDownHandler(event)"
                             y="80"/>
            </s:Group>
        
    </s:Application>

    DragDrop.png

    I came across a problem recently. I wanted to be able to use drag - and list controls dropEnabled property and (on the same canvas) use the functionality of drag-and-drop automatic implemented other components (in this case, a combination of movable labels that can drag a group component). I wanted the labels to be moved in the entire screen, but only fall on the part of the Group (NOT the list). The items in the components list were supposed to be interchangeable between the lists in the set of properties dragEnabled and dropEnabled to true. The problem is that when I drag the labels of the groups on the lists a null #1009 object reference error is thrown because the list does not try to calculate the index fall for labels. I know that I could work around the problem by setting dropEnabled = false on the lists and implement drag - move by hand, but I hope that both variants of drag-and-drop coexist in a spirit of flexibility.

    Any thoughts? Thank you very much!

    Kind regards

    Thilo

    When you delete something on a spark list you will need to provide a dragSource not null in the format 'itemsByIndex', if you change your code to something like this, it should work:

    protected function draggableLabel_mouseDownHandler(event:MouseEvent):void {}
                   
    do some data to pass to the list
    var someData:Vector. = new Vector. ();
    someData.push ("hello world");
                   
    List is waiting for data to slip with the format "itemsByIndex".
    var dragData:DragSource = new DragSource();
    dragData.addData (someData, "itemsByIndex");
                   
    DragManager.doDrag (event.currentTarget IUIComponent, dragData, events);
    }

  • Banner advertising generating the error "Flash files with network methods are not allowed."

    SWF files created in Falsh CC generates this error. No one knows how to fix?

    Click file > publishing settings > avancΘs as3 (the wrench) > and change the default link to "merged into code".

  • The date type of the column in the view

    Hello

    I would like to keep the start_date column type as a "date" type. But when create the view like below the type of the column is automatically set to varchar2 (11)

    {code}
    create table emp
    (digital emp_no
    , varchar2 (10) name
    start_date date);

    insert into the emp
    values
    (10, "Alan", January 1, 2010 "")
    insert into the emp
    values
    (20, 'Smith', may 12, 2000 ')

    create or replace view emp_v
    (emp_no
    first name
    start_date
    )
    as
    Select
    e.emp_no
    e.first_name
    , to_char (e.start_date, ' Mon-dd-yyyy "")
    from emp e
    {code}

    Thanks in advance
    Concerning
    Anna

    insert into the emp
    values
    (10, "Alan", January 1, 2010 "")
    insert into the emp
    values
    (20, 'Smith', may 12, 2000 ')

    you forcing oracle to convert string to date here - the best practice is to say explicitly what you mean with a to_date()

    the reason for which the view is created with a varchar column is that you explicitly convert a character with to_char() value, something you don't need as demonstrated above the column date.

  • How to make object view transitional Readonly/editable based on the role?

    Hello

    I have an edibable based on the connected or requriment overview to display data of transient object view read-only in the user role. It is updated to display object, we can define security at the level of the entities properties and therefore we can control access to the data. If it's the transitional view object how can we do this?

    I use ADF11g.

    Very urgent! I appreciate your help.

    Thank you.

    Hello

    You can override the method isAttributeUpdateable() of the viewRowImpl.
    There, you can check the role and return true or false to the current attribute.

    if(!hasRole && i ==YOURATTRIBUTEINDEX){
        return false;
    }
    

    Gabriel.

  • Access the views Where the access to the underlying data, through a role

    I have a user (say User1) who granted select access to motherlode via a role table

    User1 has a bunch of useful views created I want User2 to have access to the. User2 should have access only to these points of view, not to the underlying table.

    User1 can grant access to his point of view because it has no direct access granted to motherlode tables.

    I managed, based on a technique that I have for the most part, but do not entirely understand, give User2 access to data through a function. The solution is below.

    My general question is: y at - it an easier way (other than the grant direct access to the motherlode User1 tables)?

    My question is: the definition is possible shorter somehow. I know I can automate the production of the code for some of the statements using metadata, but, for example, is it possible to base the declaration of type (t_p5) on the existing view? (I have about 15 views I need to provide access)

    Solution is, where v_p5 is the original view:

    User 1:

    CREATE or replace type t_p5 as an object

    (< columns and data types of v_p5 >

    )  ;

    CREATE or REPLACE TYPE t_p5_tab AS TABLE OF THE t_p5;

    FUNCTION to CREATE or REPLACE f_provide_p5 RETURN t_p5_tab

    PIPELINED IS

    l_cur SYS_REFCURSOR;

    l_rec v_p5% rowtype;

    BEGIN

    L_cur OPEN FOR ' SELECT * FROM v_p5';

    LOOP

    EXTRACTION l_cur

    IN l_rec;

    EXIT WHEN l_cur % NOTFOUND;

    GUIDELINE (t_p5 (area = > l_rec.region))

    , district_name = > l_rec.district_name

    , current_month = > l_rec.current_month

    , p_current = > l_rec.p_current

    , previous_month = > l_rec.previous_month

    , p_prev = > l_rec.p_prev

    , diffp = > l_rec.diffp

    , diff_perc = > l_rec.diff_perc

    , previous_year = > l_rec.previous_year

    , p_year = > l_rec.p_year

    , diffy = > l_rec.diffy

    , perc_diffy = > l_rec.perc_diffy

    ));

    END LOOP;

    RETURN;

    EXCEPTION

    WHILE OTHERS THEN

    raise_application_error (-20000, SQLERRM |) Chr (10) | l_sql);

    END;

    And user2:

    VIEW to CREATE or REPLACE v_p5 AS

    SELECT * FROM TABLE (User1.f_provide_p5);

    I can then do a select * from v_p5 in User2 and return the view data.

    Thank you.

    Hello

    Don't bother with the pipeline and PL/SQL functions.  Everything will be easier, more effective and more reliable if you use only views.

    Privileges through roles do not create a view on a table in another schema.

    If user1 can create a view on motherlode.table_x, then user1 should have direct privileges already (or user1 must have a privilege of system as SELECT ANY TABLE).

    User1 needs the same privileges WITH GRANT OPTION in order to grant privileges on his point of view to User2.  To do this, have motherlode grant privileges to user1, like this:

    GRANT SELECT ON table_x to User1 WITH GRANT OPTION;

    GRANT SELECT ON table_y to User1 WITH GRANT OPTION;

    Repeat for each table that user1 uses in the views.

    Then user1 will be able to grant privileges on views to User2 like this:

    GRANT SELECT ON my_view_01 TO user2.

    This will NOT allow user2 directly see the motherlode.table_x.  User1 will have the power to give privileges to User2, but simply grant privileges on the view does not give User2 these privileges.

    If you don't want User1 to have this power, then create the views in the motherlode scheme, or create a new schema only for the putpose to own these views.

  • ViewStack container. Choose the view based on the variable command.

    Hi I am trying to implement in my application role-based access control.  I opted for a login screen which will compare users and passwords to a MySQL database.  on a match, I need to read the 'role' associated with each user.  I want to have different views for each Admin role with the role, that role will see views admin and users, a user discovers and so on.

    I managed with a button to change the view.selectedChild.  How can I use view.selectedChild = $var.

    As a test I used a dataGrid to give me choices.  But when I use the selectionChange like this event handler

    protected function dataGrid_selectionChangeHandler(event:GridSelectionEvent):void
                                  {
                                            view.selectedChild = dataGrid.selectedItem.role;
                                  }
    

    It does not change the view.

    Is it possible to use ViewStack for control of access in this way?

    SelectedChild is a point of view.  What is the role?  What is an int or a string?  I would like to map it to selectedIndex instead.

    But really, I wouldn't use ViewStack and use view States that match name role.

Maybe you are looking for

  • Empty DVD compatibility with burner on SP P100

    I have a Satellite Pro P100-309 and want to know what blank DVD is compatible with my burner. Thank you

  • Tecra R940-DCK drivers

    Hello!3 days ago bouht a new R940 Tecra-DCK, model? : PT43HR-04N02SRU. (3210 i5, memory 6 GB, HM76 chipset)I installed SDS and Windows 7 x 64 without issues, but now have a little problems with the drivers. I can't find this laptop Toshiba (by S/N an

  • Satellite P300 freezing after more than 20 minutes

    Hello I hope someone can help.My satellite P300 laptop freezes when left for more than 20 minutes.This has been a problem since the purchase of the laptop 8 months ago. I have windows vista installed. When this happens I've pressed the button until t

  • I created a microsft account on my pc and Ive forgot the password

    Original title: password HELP! Basically, I put a microsft account on my pc and Ive forgot the password! I really need all the documents and the itunes which is in this account so jist delete the account and restart is not an option! I need the itune

  • No icons in the menu desktop & start in Windows XP computer.

    Original title: object: click Start nothing it empty. I have windows XP media edition SP3 and all the icons on the left side of the screen as well as in the start menu are gone. Go to all programs says empty. Have been able to restore internet explor