What TACACS+ server are you using?
If it helps, one of the labs I built some time back used a variation of Cisco's TACACS+ server. The user config looked like this:
# Configure User
user = drew {
login = cleartext "mypassword"
service = exec {
priv-lvl = 15
}
cmd = show {
permit .*
}
cmd = download {
permit .*
}
}
user = admin {
default service = permit
login = cleartext ""
}This gave "drew" an admin level account that could only run show and download commands, and denied everything else. You can also explicitly deny certain commands. The admin account was configured as it normally is on the switch by default.
