Hello Brian,

I think this previous thread would be of help:

 Radius question 

If not then let me know.

Thanks.

Regards,

Luciano Testa

I reviewed this thread but I do not think it applies to my situation, I cannot find the shell attribute in any of the Cisco dictionaries.

Here is a Cisco doc that I am following with the FreeRADIUS configurations; https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/116291-configure-freeradius-00.html#anc6

Example of users file:

DEFAULT Auth-Type = System
        Service-Type = NAS-Prompt-User,
        cisco-avpair :="shell:priv-lvl=15"


AAA is configured on CISCO with

aaa authorization exec default group radius if-authenticated

I believe the above example should set the privilege level 15 for user authenticated via the AA appliance, but I cannot make it work.

Any ideas on this issue?


Thank you

BUMP

Checking back if anyone has an idea on how to get NetIQ Advanced Authentication to push the exec level 15 back to an SSH client?

Vanilla FreeRADIUS can be configured to handle this function , but I cannot figure-out how to get NetIQ AA to handle it.

Thanks 

Brian

Brian Willhite said:

I reviewed this thread but I do not think it applies to my situation, I cannot find the shell attribute in any of the Cisco dictionaries

Attribute name is on the left side of equals side, so attribute is "Cisco-AVPair", not "shell". And the value for attribute is "shell:priv-lvl=15"

It looks like this attribute is in dictionary.cisco file (see https://github.com/redBorder/freeradius/blob/master/share/dictionary.cisco)

My apologies for not seeing the Cisco-AVPair in the dictionary!

My next issue I do not know how to configure the results specification rule to push an attribute and value pair, based on the documentation it is used to return a user attribute value.

Do I need to add shell:priv-lvl=15 as a value to the user in AD and have the result rule pull the value?

Thanks a million for all the assistance

I believe I have figured it out , I set the result-attribute to Cisco-AVPair and the result to shell:priv-lvl=15, BAM! it worked!

Thanks a million and I'm sure you'll hear from me again.  ;)