ASR9k + Freeradius
Refer to IOX + Freeradius article that very less on Internet and lots of IOS with Freeradius, after study that, I summarized that by follow:
1: Install freeradius
You need install free radius first, ignore the part, you can check it by yourself or check my last article <RHEL7 install freeradius>
2: Config freeradius
clients.conf
[root@frank radius]# more /etc/raddb/clients.conf
client 10.x.x.x {
secret = cisco123
shortname = iox-5.2.2
nas_type = cisco
}
users
Notes: as follow, we can assign a group for user “frank”, now priv5 is custom group, you can assign default group, e.g:
Cisco-avpair = “shell:task=#netadmin,#sysadmin,#cisco-support”Btw, you can direct defined priv15 by follow:
Cisco-AVPair = “shell:priv-lvl=15”Or direct defined cmd by follow:
Cisco-AVpair = “shell:cmd=show”If you assign cisco-support group first, and then to limit command by “cmd=show”, cmd will unavailable; and vice versa.
[root@frank radius]# more /etc/raddb/users
frank Cleartext-Password := "frank"
Service-Type = NAS-Prompt-User,
Reply-Message = "Hello!",
Login-Service = Telnet,
Cisco-AVPair = "shell:tasks*=#priv5,"