Cisco Systems Configuring Management Access Accounting, Viewing the Currently Logged-In User

40-28
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter40 Configuring Management Access
Configuring AAA for System Administrators
Configuring Management Access Accounting
You can send accounting messages to the TACACS+ accounting server when you enter any command
other than show commands at the CLI. You can configure accounting when users log in, when they enter
the enable command, or when they issue commands.
For command accounting, you can only use TACACS+ servers.
To configure management access and enable command accounting, perform the following steps:
Detailed Steps
Step1 To enable accounting of users when they enter the enable command, perform the following steps:
a. Choose Configuration > Device Management > Users/AAA > AAA Access > Accounting, and
check the Require accounting to allow accounting of user activity > Enable check box.
b. From the Server Group drop-down list, choose a RADIUS or TACACS+ server group name.
Step2 To enable accounting of users when they access the ASA using Telnet, SSH, or the serial console,
perform the following steps:
a. Under the Require accounting for the following types of connections area, check the check boxes
for Serial, SSH, and/or Telnet.
b. For each connection type, from the Server Group drop-down list, choose a RADIUS or TACACS+
server group name.
Step3 To configure command accounting, perform the following steps:
a. Under the Require command accounting area, check the Enable check box.
b. From the Server Group drop-down list, choose a TACACS+ server group name. RADIUS is not
supported.
You can send accounting messages to the TACACS+ accounting server when you enter any
command other than show commands at the CLI.
c. If you customize the command privilege level using the Command Privilege Setup dialog box, you
can limit which commands the ASA accounts for by specifying a minimum privilege level in the
Privilege level drop-down list. The ASA does not account for commands that are below the
minimum privilege level.
Step4 Click Apply.
The accounting settings are assigned, and the changes are saved to the running configuration.
Viewing the Currently Logged-In User
To view the current logged-in user, enter the following command in the Tools > Command Line Interface
tool:
show curpriv
The following is sample output from the show curpriv command:
show curpriv
Username: admin
Current privilege level: 15