<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi!,</p>
I have set up a tac_plus server to authorize certain users to run show commands on a Cisco ASA running 9.9.<br>
<br>
My configuration looks like the following:<br>
group = read-only {<br>
default service = permit<br>
service = exec {<br>
priv-lvl = 15<br>
}<br>
<br>
}<br>
<br>
user = bob {<br>
login = des $1$VF$kBGTjygux4xckHjGUSSwd1<br>
service = shell { priv-lvl=5 }<br>
cmd = show { permit .* }<br>
member = read-only<br>
}<br>
<br>
However, in the logs, i can see this: <br>
<font face="Cambria">Fri Jan 26 11:09:08 2018 [31706]: Start authorization request<br>
Fri Jan 26 11:09:08 2018 [31706]: do_author: user='enable_15'<br>
Fri Jan 26 11:09:08 2018 [31706]: user 'enable_15' found<br>
Fri Jan 26 11:09:08 2018 [31706]: authorize_cmd: user=enable_15, cmd=show<br>
Fri Jan 26 11:09:08 2018 [31706]: cmd show does not exist, denied by default<br>
<br>
Why is this?<br>
</font><br>
</body>
</html>