Hi List, I have been testing pattern matching with ACS shell command auth sets and it doesn't seem to work like the ACS documentation says.
Quote from the Cisco ACS user guide: *For permit or deny command arguments, ACS applies pattern matching. That is, the argument permit wid matches any argument that contains the string wid. Thus, for example, permit wid would allow not only the argument wid but also the arguments anywid and widget.* *To limit the extent of pattern matching you can add the following expressions:* *• Dollarsign ($)* *—Expresses that the argument must end with what has gone before. Thus permit wid$ would match wid or anywid, but not widget.* *• Caret (^)* *—Expresses that the argument must begin with what follows. Thus permit ^wid would match wid or widget, but not anywid. You can combine these expressions to specify absolute matching. In the example given, you would use permit ^wid$ to ensure that only wid was permitted, and not anywid or widget.* *To permit or deny commands that carry no arguments, you can use absolute matching to specify the null argument condition. For example, you use permit ^$ to permit a command with no arguments. Alternatively, entering permit <cr> has the same effect. You can use either method, with the Permit Unmatched Args option unchecked, to match and, therefore, permit or deny commands that have no agrument.* ---------------------------------------------------------------------------------------- So from this I take that if I want to deny configuration of certain interfaces say Loopback0, while allowing configuration of Loopback99, I will, permit "interface" , with the sub-command arguments: permit*^Loopback99$ *, unmatched commands are "deny" and "Permit Unmatched Args" is unchecked. Thinking that would allow the command interface Loopback99 but actually the "interface Loopback99" commands, fails authorization. On the other side, if I permit *^Loopback* only, all loopbacks get permitted. It seems like the "^" pattern matching works but the "$" doesn't. Anyone have any experience with pattern matching that can help me out? -- Regards, M Usman Ashraf _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
