<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hi, all,</p>
<p><br>
</p>
I'm running TACACS+ version 4.0.4.28 on Ubuntu 16.04, and I'm seeing
in my testing of command authorization some odd truncation of
commands. The relevant portion of my config limits a group of users
to certain 'no' commands, in particular, 'no switchport mode
access'. The config line looks like this:<br>
<br>
cmd = no {<br>
...<br>
permit "switchport mode access <cr>"<br>
...<br>
}<br>
<br>
My TACACS logs show that when I run the 'no switchport mode access'
command from a Cisco 3550 (running IOS 12.2(44)SE6), I get an
authorization failure result. The relevant log result shows that the
command that's being compared against doesn't include the last term:<br>
<br>
[27071]: line 228 compare no permit 'switchport mode access
<cr>' & 'switchport mode <cr>' no match<br>
<br>
The Cisco logs record the full command:<br>
<br>
%PARSER-5-CFGLOG_LOGGEDCMD: User:tmonkey logged command:switchport
mode access<br>
<br>
Has anyone seen anything like this before? <br>
<div class="moz-signature">-- <br>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<br>
<div class="moz-signature">
<div class="moz-signature">____________ <br>
<meta http-equiv="content-type" content="text/html;
charset=utf-8">
<title></title>
<p><font face="Helvetica, Arial, sans-serif" size="-1">Mason
Moody<br>
Network Security Engineer<br>
Atlantic.Net<br>
Phone: 800-422-2936 x4431<br>
Int'l: +1-321-206-3731</font></p>
<p><img alt=""
src="cid:part1.ED8BEE0F.D67EC5AF@staff.atlantic.net"
height="18" width="156"></p>
</div>
</div>
</div>
</body>
</html>