Subject: (radius) Command execution

From: Indranil Bagchi <[email-masked]>
Date: Thu, 8 Jul 1999 16:14:41 -0700

I am required to enhance the login shell on a switch enabling users to
execute certain predefined commands. For example if the shell supports
10 commands, I would like to create user profiles and allow a specific
user to execute a particular set of commands.

E.g.. User A can execute commands 1,5 and 9.
     User B can execute commands 3 and 6 etc.

We plan to use a radius server to define such associations and allow/deny
a particular user for executing a particular command. For example, if 
User B wants to execute any command other than 3 and 6, the radius
server should deny it.

Are there implementations which support this kind of a feature and how
can one achieve it in the radius framework.

Thanks
 
-
To unsubscribe, email [email-masked]' with
'unsubscribe ietf-radius' in the body of the message.

---

From: "[email-masked]" <[email-masked]>
Date: Fri, 9 Jul 1999 05:50:39 -0700 (PDT)

> can one achieve it in the radius framework.
The answer is no, RADIUS cannot really do that. However, one way around this
problem would be to make use of the Filters. This would require that you
pre-configure a set of filters, where filter A would allow commands 1, 5 and
9, etc. Then user A would have, as part of his/her profile, filter A.

This is probably not ideal, so if you want a better way, simply start creating
vendors specific Attributes. Hell, there are more of them out there than the
ones defined in the RFCs :)

PatC

-