TACACS+ daemon + Cisco gear - Question concerning authentication setting

suraty · 12-31-2011, 01:48 AM

Hello Group,

I am using the following TACACS+ daemon:

TACACS+ daemon: Shrubbery Networks - TACACS+ daemon
URL: http://www.shrubbery.net/tac_plus/

The daemon is configured to reference PAM to take care of authentication.

Code:

group = netadmin {
  default service = permit

  service = exec {
    priv-lvl = 15
  }
}

user = user1 {
  login = PAM
  member = netadmin
}

The authentication / authorization seems to be working when I login into the Cisco gear. However, it takes me straight to enable mode after login. I am trying to configure TACACS to first bring me to user mode, then to enable mode after typing the command 'enable', then my password respectively.

I would like to keep the 'login = PAM' method as PAM is configured to reference Openldap for passwords.

Any advice will be greatly appreciated.

Regards,
Suraty

agentbuzz · 12-31-2011, 04:08 PM

suraty,

Quote:

priv-lvl = 15

Privilege level 15 is enable mode. Try changing that 15 to a "1".

suraty · 12-31-2011, 05:36 PM

Hello agentbuzz,

Thank you for your reply. I get the following error when I try to change to enable mode with 'priv-lvl =1'.

% Error in authentication.

Regards,
Suraty

suraty · 01-01-2012, 12:08 AM

Hello Group,

After posting my previous reply, I realized that the enable authentication is not working at all with 'priv-lvl = 15'.
After my initial login to the router, it takes me to enable mode. When I try disable then enable, the router gives me the following message:

Code:

% Error in authentication.

I believe this means I have problem with my enable settings.
I updated my tac_plus.conf user settings to:

Code:

user = user1 {
  login = PAM
  enable = PAM
  member = netadmin
}

After reload I get the following error:

Code:

expecting 'file', 'cleartext', 'nopassword', or 'des' keyword after 'enable ='

I believe the version of the TACACS+ I am using is incompatible with PAM for enable passwords.

Is there a work around to get enable authentication working with PAM?

suraty