Cisco ASA Series Cli Configuration Manual page 1011

Chapter 1 Configuring Management Access
Credentials
required
Username
Password
Privileged Mode
Password
Security Contexts and Command Authorization
The following are important points to consider when implementing command authorization with
multiple security contexts:
•
•
Note
The system execution space does not support AAA commands; therefore, command authorization is not
available in the system execution space.
Username and
Password
Authentication
Yes
Yes
No
AAA settings are discrete per context, not shared among contexts.
When configuring command authorization, you must configure each security context separately.
This configuration provides you the opportunity to enforce different command authorizations for
different security contexts.
When switching between security contexts, administrators should be aware that the commands
permitted for the username specified when they login may be different in the new context session or
that command authorization may not be configured at all in the new context. Failure to understand
that command authorizations may differ between security contexts could confuse an administrator.
This behavior is further complicated by the next point.
New context sessions started with the changeto command always use the default enable_15
username as the administrator identity, regardless of which username was used in the previous
context session. This behavior can lead to confusion if command authorization is not configured for
the enable_15 user or if authorizations are different for the enable_15 user than for the user in the
previous context session.
This behavior also affects command accounting, which is useful only if you can accurately associate
each command that is issued with a particular administrator. Because all administrators with
permission to use the changeto command can use the enable_15 username in other contexts,
command accounting records may not readily identify who was logged in as the enable_15
username. If you use different accounting servers for each context, tracking who was using the
enable_15 username requires correlating the data from several servers.
When configuring command authorization, consider the following:
•
An administrator with permission to use the changeto command effectively has permission to
use all commands permitted to the enable_15 user in each of the other contexts.
•
If you intend to authorize commands differently per context, ensure that in each context the
enable_15 username is denied use of commands that are also denied to administrators who are
permitted use of the changeto command.
When switching between security contexts, administrators can exit privileged EXEC mode and enter
the enable command again to use the username that they need.
Configuring AAA for System Administrators
Privileged
Mode
Serial Command
Authorization Authorization
No No
No No
No Yes
Cisco ASA Series CLI Configuration Guide
Privileged
Mode Exit
Authorization
Yes
Yes
No
1-17