How to permit all show commands (including running-config)?

[Kleinrotti]

How can I permit all show commands including show running-config (which is not included in privilege 1)?
I have already tried this but show running-config can't be executed:

acl read_acl {
		# cisco ios
		if (service == shell) {
			if (cmd == "")
				set priv-lvl = 1
                permit
			if (cmd =~ /^show /)
				permit
            if (cmd =~ /^exit /)
				permit
            deny
		}
	}

When I set priv-lvl to 15 the user can execute every command which I don't want.
I think I'm doing something wrong here.

[MarcJHuber]

Hi,

I'd guess that you forgot to configure command authorization on the router. priv-lvl=15 plus aaa authorization command ... should do what you want.

Cheers,

Marc

[Kleinrotti]

I have these already configured on the Switch:
aaa authorization commands 1 default group tacacs+ if-authenticated
aaa authorization commands 15 default group tacacs+ if-authenticated

[Kleinrotti]

Ok got it working, there was also some old aaa authorization command still configured. I removed that and it work now. Thanks :)

[bantify]

@Kleinrotti
Is it on cisco router?

I trying to look authorization commands in extreme switch, looks like it does not support authorization.