Is there a way, to create such privilege, which will let to configure just one particular port ex: gi1/0/1 , but at that time will not let to configure gi1/0/2 .
Smth like: privilege interface gi1/0/1 10
UPD: As radius said, from /usr/local/share/doc/tac_plus/users_guide :
The following configuration example permits user Fred to run the
following commands:
telnet 131.108.13.<any number> and
telnet 128.<any number>.12.3 and
show <anything>
All other commands are denied (by default).
user=fred {
cmd = telnet {
# permit specified telnets
permit 131\.108\.13\.[0-9]+
permit 128\.[0-9]+\.12\.3
}
cmd = show {
# permit show commands
permit .*
}
}
No, IOS's permissions are not this granular unfortunately.
You can use a TACAS+ server to do this using authorization, see http://www.cisco.com/en/US/docs/ios/security/configuration/guide/sec_cfg_authorizatn.html#wp1001170