Skip to content

Commit 1279f33

Browse files
committed
remove nvue restart fro tacacs per command aut
1 parent 8a4bc8f commit 1279f33

1 file changed

Lines changed: 0 additions & 7 deletions

File tree

  • content/cumulus-linux-517/System-Configuration/Authentication-Authorization-and-Accounting

content/cumulus-linux-517/System-Configuration/Authentication-Authorization-and-Accounting/TACACS.md

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -422,19 +422,13 @@ TACACS per-command authorization supports {{<link url="NVUE-CLI/#command-complet
422422
423423
The following command allows TACACS+ users at privilege level 0 to run the `nv` and `ip` commands.
424424
425-
{{%notice note%}}
426-
- Ensure that TACACS+ servers are reachable before setting new command authorization rules.
427-
- After configuring TACACS+ per-command authorization, you must restart the NVUE service.
428-
{{%/notice%}}
429-
430425
{{< tabs "TabID392 ">}}
431426
{{< tab "NVUE Commands ">}}
432427
433428
```
434429
cumulus@switch:~$ nv set system aaa tacacs authorization 0 command ip
435430
cumulus@switch:~$ nv set system aaa tacacs authorization 0 command nv
436431
cumulus@switch:~$ nv config apply
437-
cumulus@switch:~$ sudo systemctl restart nvued.service
438432
```
439433
440434
To show the per-command authorization settings, run the `nv show system aaa tacacs authorization` command:
@@ -456,7 +450,6 @@ When you configure per-command authorization on the switch, only define the init
456450
457451
```
458452
cumulus@switch:~$ sudo tacplus-restrict -i -u tacacs0 -a ip nv
459-
cumulus@switch:~$ sudo systemctl restart nvued.service
460453
```
461454
462455
The `tacplus-auth` command handles authorization for each command. To make this an enforced authorization, change the TACACS+ log in to use a restricted shell, with a very limited executable search path. Otherwise, the user can bypass the authorization. The `tacplus-restrict` utility simplifies setting up the restricted environment.

0 commit comments

Comments
 (0)