Tacacs authentication to firewall

[bob111]

Hello guys, I set up tacacs to my firewalls and I wanted to know if there is a way to log in straight to expert mode?
Thanks! 

[Lesley]

This can be done via the clish mode with:

set user admin shell /bin/bash

[AkosBakos]

@Lesley 

Not 100% sure, but, TACACS user always "starts" in clish mode, or not?

Of course, you always set the default privilage (not the maximum), which is CLISH

 

https://support.checkpoint.com/results/sk/sk98733

Akos

[Lesley]

Ah yes this is true 

After login, you can use the Gaia Clish command 'tacacs_enable TACP-15' to gain full privileges.
The security goal is to require a different password after logging in to deter malicious activities.
An Expert password that differs from all TACACS passwords, provides even more security.

HostName> add rba role TACP-15 domain-type System readwrite-features backup,clock-date,cluster_ha,configuration,expert,export,hw-monitor,message,perf,reboot_halt,revert,show-route-all,snapshot,static-route,syslog,tacacs_enable

[bob111]

Thank you very much for the help! So just to be clear there is no way for a tacacs user to log in to expert mode directly?

[PhoneBoy]

All "non local" users are impacted by this entry in /etc/passwd: 

_nonlocl:x:96:100:Non-local user:/home/_nonlocl:/etc/cli.sh

You can change this by editing /etc/passwd manually, but it impacts all TACACS+ and RADIUS servers.