# SSH local database question

**URL:** <https://forum.networklessons.com/t/ssh-local-database-question/14835>\
**Category:** ASA\
**Created:** [July 7, 2021, 6:35pm UTC](https://forum.networklessons.com/t/ssh-local-database-question/14835 "2021-07-07T18:35:36Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![techjess323](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/techjess323/32/5839_2.png) [@techjess323](https://forum.networklessons.com/u/techjess323)\
**Post date:** [July 7, 2021, 6:35pm UTC](https://forum.networklessons.com/t/ssh-local-database-question/14835/1 "2021-07-07T18:35:36Z")

</div>

We have enabled the cisco anyconnect feature on our ASA and currently have all the users locally in the ASA. My question is, can I limit on which user(s) can log in using ssh? We currently have ACLs setup so that only 4 computers can get there, but I would feel more comfortable if I could limit users. Is there a way? Thank You in advanced.

---

<div class="post-metadata">

**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\
**Post date:** [July 9, 2021, 6:36am UTC](https://forum.networklessons.com/t/ssh-local-database-question/14835/2 "2021-07-09T06:36:59Z")

</div>

Hello Jesse

It is possible to limit user CLI and ADSM access based on the user logging in. This can be for RADIUS, LDAP, TACACS+ as well as for the local database, using management authorization.

Specifically, you must set the `service-type` of each user. By default, the service type is `admin` which gives access to any services specified by the `aaa authentication console` command. This must be changed like so for the specific user:

`hostname(config-username)# service-type remote-access`

The `remote-access` keyword denies management access. The user cannot use any services specified by the `aaa authentication console LOCAL` commands.

More information about this can be found at the following Cisco documentation:

> **[Cisco ASA 5500 Series Configuration Guide using the CLI, 8.4 and 8.6 -...](https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/access_management.html#62263)**
>
> Configuring Management Access

> **[Cisco ASA 5500 Series Configuration Guide using the CLI, 8.4 and 8.6 -...](https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/access_aaa.html#89869)**
>
> Configuring AAA Servers and the Local Database

I hope this has been helpful!

Laz

---

<div class="post-metadata">

**Author:** ![techjess323](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/techjess323/32/5839_2.png) [@techjess323](https://forum.networklessons.com/u/techjess323)\
**Post date:** [July 9, 2021, 3:06pm UTC](https://forum.networklessons.com/t/ssh-local-database-question/14835/3 "2021-07-09T15:06:37Z")

</div>

Hi Laz, this was extremely helpful.. Just so Im clear as I am reading the documentation as well, enabling remote access will only allow the user network access(vpn)?

---

<div class="post-metadata">

**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\
**Post date:** [July 12, 2021, 5:42am UTC](https://forum.networklessons.com/t/ssh-local-database-question/14835/4 "2021-07-12T05:42:08Z")

</div>

Hello Jesse

Glad to hear that it was of help. Yes, that is the case. You can see from [this section of the documentation](https://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/access_aaa.html#pgfId-1055124) that:

> The remote-access keyword denies management access. The user cannot use any services specified by the aaa authentication console LOCAL commands (excluding the serial keyword; serial access is allowed).

I hope this has been helpful!

Laz

---

<div class="post-metadata">

**Author:** ![techjess323](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/techjess323/32/5839_2.png) [@techjess323](https://forum.networklessons.com/u/techjess323)\
**Post date:** [July 19, 2021, 4:04pm UTC](https://forum.networklessons.com/t/ssh-local-database-question/14835/5 "2021-07-19T16:04:20Z")

</div>

Thank you so much Laz. This helped a lot. I am glad I found this site.