Understanding the network.pdf - Back to Home

and
The authorization process works by having the router check the user's
authentication method and access privileges. If they meet the
configured authorization requirements, access to the command is
permitted. This means you have to configure the
users'RADIUS/TACACS user profiles to reflect the specific types of
services they need. This can be quite a task, so you must decide if the
work is worth the return.
Configuring Accounting
Accounting is one of those things you just need to do, especially with
services like dial-in, where security risks are high. Accounting gives
you the ability to track service abuse and login failures, generate
usage statistics, and so on. If you are not using some kind of system
accounting on at least your high-risk system, you really should do so.
There are two types of IOS accounting: user and operations. IOS
provides access information on network sessions (PPP, SLIP, ARA)
and outbound connections (such as Telnet, rlogin). Operational
accounting, on the other hand, tracks the information pertaining to
router-centric activities. The IOS splits operational accounting
between two accounting systems:
• accounting—Provides system event information
(similar to logging information)
• accounting—Keeps track of EXEC shell commands
usage
IOS accounting requires a TACACS+ or RADIUS server to process the
accounting records. The records are collections of attribute-value