For small businesses, using an external user database such as Cisco ACS is not always feasible. Fortunately, Cisco ASA software includes the ability to use a local user database for authenticating administrators and remote access users.

The commands are pretty straight forward: to add a user, enter the username command. For example:

Firewall(config)# username bgeorge password b3lucky

By default, the ASA assigns users a privilege level of 2. On a scale of 0 to 15, this sounds harmless. However, this is enough to allow access to all commands within privileged EXEC mode! Those coming from an IOS background assume the enable password will prevent users from gaining access to privileged mode - not the case. By default, a user can enter the login command from user EXEC mode which allows them privileged EXEC access with their assigned level. For example, the user bgeorge accesses the ASA user EXEC mode:

Firewall> login
Username: bgeorge
Password: b3lucky
Firewall# show curpriv
Username : bgeorge
Current privilege level : 2
Current Mode/s : P_PRIV
Firewall#


The user bgeorge now has full access to the ASA!

The simple way to prevent this is make sure you assign a privilege level to each user. If bgeorge is a remote-access user, assign a privilege of 0. Also, enabling local command authorization will mean even users with a default privilege level of 2 won’t have access to practically any command from within privileged EXEC mode. To activate local command authorization, enter the following:

Firewall(config)# aaa authorization command LOCAL

You can view the commands and their default privilege level as follows:

Firewall# sh run all privilege all

Administrators may wish to keep the enable password different from the user password (similar to IOS). If you wish to do this, ensure all user accounts are set to privilege level 0. To access privileged mode, use the enable command followed by the enable password. This places you at level 15 as user ‘enable_15′. The recommended method is to configure authentication for the enable command as follows:

Firewall(config)# aaa authentication enable console LOCAL

This forces users into their assigned privileged level by requiring their own password instead of the enable one. For example, typing the enable command from user EXEC mode now requires the user’s password, not the enable password. There is no indication of this to the user as the prompt is the same. Used in conjunction with local command authorization, this provides a basic level of security to the administration of your ASA.

Finally, if you do add users to the local database for remote-access, you can restrict them access to a specific group using the group-lock command. By default, the users are allowed to access any group as they inherit this from the default group policy. The following is an example of how to configure this:

Firewall(config)# username johnd password c1sc0 privilege 0
Firewall(config)# username johnd attributes
Firewall(config-username)# group-lock value vpn-admin


This will limit user johnd to the vpn-admin group.

This entry was posted on Friday, January 11th, 2008 at 2:55 pm and is filed under Config. Guides. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.