HP ProCurve 9304M Security Manual page 47

In a configuration that has both an "hp-privlvl" A-V pair and a non-"hp-privlvl" A-V pair for the Exec service, the
non-"hp-privlvl" A-V pair is ignored. For example:
user=bob {
default service = permit
member admin
# Global password
global = cleartext "cat"
service = exec {
hp-privlvl = 4
privlvl = 15
}
}
In this example, the user would be granted a privilege level of 4 (port-config level). The privlvl = 15 A-V pair
is ignored by the HP device.
If the TACACS+ server has no A-V pair configured for the Exec service, the default privilege level of 5 (read-only)
is used.
Configuring Command Authorization
When TACACS+ command authorization is enabled, the HP device consults a TACACS+ server to get
authorization for commands entered by the user.
You enable TACACS+ command authorization by specifying a privilege level whose commands require
authorization. For example, to configure the HP device to perform authorization for the commands available at the
Super User privilege level (that is, all commands on the device), enter the following command:
ProCurveRS(config)# aaa authorization commands 0 default tacacs+
Syntax: aaa authorization commands <privilege-level> default tacacs+ | radius | none
The <privilege-level> parameter can be one of the following:
• 0 – Authorization is performed for commands available at the Super User level (all commands)
• 4 – Authorization is performed for commands available at the Port Configuration level (port-config and read­
only commands)
• 5 – Authorization is performed for commands available at the Read Only level (read-only commands)
NOTE: TACACS+ command authorization can be performed only for commands entered from Telnet or SSH
sessions, or from the console. No authorization is performed for commands entered at the Web management
interface or SNMP management applications.
TACACS+ command authorization is not performed for the following commands:
• At all levels: exit, logout, end, and quit.
• At the Privileged EXEC level: enable or enable <text>, where <text> is the password configured for the Super
User privilege level.
If configured, command accounting is performed for these commands.
AAA Support for Console Commands
To enable AAA support for commands entered at the console, enter the following command:
ProCurveRS(config)# enable aaa console
Syntax: [no] enable aaa console
June 2005
Securing Access to Management Functions
2 - 31