Cisco Systems Servers Benutzerhandbuch

Command authorization sets provide a central mechanism to control the 
authorization of each command on each network device. This greatly enhances the 
scalability and manageability of setting authorization restrictions. In 
Cisco Secure ACS, the default command authorization sets include the Shell 
Command Authorization Sets and the PIX Command Authorization Sets. Other 
Cisco network management applications, such as CiscoWorks2000, may be 
enabled to instruct ACS to support additional command authorization set types.

To offer fine-grained control of network devices, by administrators, using a Telnet 
administration session, a network device using TACACS+ can request 
authorization for each command line before its execution. Cisco Secure ACS 
administrators can define a set of commands, which are either permitted or denied 
for execution by a particular user on a given device. Cisco Secure ACS has further 
enhanced this capability as follows:

Reusable Named Command Authorization Sets—You can create a named 
set of device commands without directly citing any user or user group. The 
administrator can define a number of device command sets, each of which 
delineates different access profiles. For example, a “help desk” device 
command set could permit access to high level browsing commands, such as 
“show run”, and deny any configuration commands. An “All network 
engineers” command set could contain a limited list of permitted device 
commands for any network engineer in the enterprise. The “Local Network 
Engineers” command set could permit all device commands, including 
IP-address configuration.

Finer Configuration Granularity—You can create associations between 
named command authorization sets and NDGs. Thus, you are able to define 
different access profiles for users depending on which network devices they 
access. You can associate the same named command authorization set with 
more than one NDG and use it for more than one user group. 
Cisco Secure ACS enforces data integrity. Named command authorization 
sets are kept in the CiscoSecure user database and can be backed up/restored 
by the Cisco Secure ACS backup and restore features and replicated to 
secondary Cisco Secure ACS servers along with other configuration.