<br><font size=2 face="sans-serif"><b><u>Logs on the Tacacs+ Server :</u></b></font>
<br>
<br><font size=2 face="sans-serif"><b><u>Jun 27 03:40:43 netmgr tac_plus[22460]:
Version F4.0.4.10 Initialized 1</u></b></font>
<br><font size=2 face="sans-serif"><b><u>Jun 27 03:50:21 netmgr tac_plus[22462]:
session.peerip is 10.115.111.215</u></b></font>
<br><font size=2 face="sans-serif"><b><u>Jun 27 03:50:21 netmgr tac_plus[23406]:
connect from 10.115.111.215 [10.115.111.215]</u></b></font>
<br><font size=2 face="sans-serif"><b><u>Jun 27 03:50:22 netmgr tac_plus[23406]:
pap-login query for 'chetan' ssh from 10.115.111.215 rejected</u></b></font>
<br>
<br><font size=2 face="sans-serif"><b><u>/var/log/secure on the Network
Client :</u></b></font>
<br>
<br><font size=2 face="sans-serif"><b><u>Jun 27 13:18:53 cjain-test sshd[27081]:
Deprecated pam_stack module called from service "sshd"</u></b></font>
<br><font size=2 face="sans-serif"><b><u>Jun 27 13:18:53 cjain-test sshd[27081]:
pam_sm_authenticate: called (pam_tacplus v1.2.9)</u></b></font>
<br><font size=2 face="sans-serif"><b><u>Jun 27 13:18:53 cjain-test sshd[27081]:
pam_sm_authenticate: user [chetan] obtained</u></b></font>
<br><font size=2 face="sans-serif"><b><u>Jun 27 13:18:53 cjain-test sshd[27081]:
tacacs_get_password: called</u></b></font>
<br><font size=2 face="sans-serif"><b><u>Jun 27 13:18:53 cjain-test sshd[27081]:
tacacs_get_password: obtained password [H M?INCORRECT]</u></b></font>
<br><font size=2 face="sans-serif"><b><u>Jun 27 13:18:53 cjain-test sshd[27081]:
pam_sm_authenticate: pass [H M?INCORRECT] obtained</u></b></font>
<br><font size=2 face="sans-serif"><b><u>Jun 27 13:18:53 cjain-test sshd[27081]:
pam_sm_authenticate: tty [ssh] obtained</u></b></font>
<br><font size=2 face="sans-serif"><b><u>Jun 27 13:18:53 cjain-test sshd[27081]:
pam_sm_authenticate: trying srv 0</u></b></font>
<br><font size=2 face="sans-serif"><b><u>Jun 27 13:18:53 cjain-test sshd[27081]:
tac_authen_pap_read: authentication failed, server reply was 2 (Login incorrect)</u></b></font>
<br><font size=2 face="sans-serif"><b><u>Jun 27 13:18:53 cjain-test sshd[27081]:
Failed password for invalid user chetan from 10.115.100.100 port 3610 ssh2</u></b></font>
<br>
<br><font size=2 face="sans-serif">I am not sure why its showing some password
which was not typed.... I think its the issue with the pam_tacacs installed
on the network client... Can somebody suggest me what could be the issue......</font>
<br>
<br>
<br><font size=2 face="sans-serif">Thanks and Regards,<br>
Chetan Jain<br>
Network Team - IR,<br>
Monitor Group,<br>
131 Free Press House,<br>
Nariman Point, Mumbai.<br>
India</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=40%><font size=1 face="sans-serif"><b>john heasley <heas@shrubbery.net></b>
</font>
<p><font size=1 face="sans-serif">06/26/2007 10:42 PM</font>
<td width=59%>
<table width=100%>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td><font size=1 face="sans-serif">Chetan_Jain@Monitor.com</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td><font size=1 face="sans-serif">tac_plus@shrubbery.net</font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td><font size=1 face="sans-serif">Re: [tac_plus] PAM authentication</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><tt><font size=2>Tue, Jun 26, 2007 at 09:28:16PM +0530, Chetan_Jain@Monitor.com:<br>
> Hi,<br>
> <br>
> I am trying to authenticate sshd service on a linux system through
<br>
> tacacs+.... <br>
> <br>
> Tacacs+ server IP : 10.1.100.114<br>
> Network Client : 10.115.111.215<br>
> <br>
> I am starting tacacs+ using tac_plus -d 8 -C <br>
> /opt/WiKID/private/tacacs.conf<br>
> <br>
> # This file is dynamically written by the WiKID server<br>
> # manual changes to this file will be overwritten almost immediately<br>
> <br>
> key = "cooler"<br>
> accounting file = /opt/WiKID/log/tacacs.accounting.log<br>
> <br>
> user = chetan { <br>
> default service = permit<br>
> chap = cleartext "605992"<br>
> pap = cleartext "605992"<br>
> arap = cleartext "605992"<br>
> login = des chRQBOhi.agrM<br>
> }<br>
> <br>
> On the Network Client side.... <br>
> <br>
> /etc/pam.d/tacacs :<br>
> <br>
> #%PAM-1.0<br>
> auth sufficient /lib/security/pam_tacplus.so
debug \ <br>
> server=10.1.100.114 secret=cooler encrypt<br>
> account sufficient /lib/security/pam_tacplus.so
debug \<br>
> server=10.1.100.114 secret=cooler encrypt service=shell
protocol=ssh<br>
> session sufficient /lib/security/pam_tacplus.so
debug \<br>
> server=10.1.100.114 secret=cooler encrypt service=shell
protocol=ssh<br>
> <br>
> /etc/pam.d/sshd :<br>
> <br>
> #%PAM-1.0<br>
> auth sufficient pam_stack.so service=tacacs<br>
> #auth required pam_stack.so service=system-auth<br>
> auth required pam_nologin.so<br>
> account sufficient pam_stack.so service=tacacs<br>
> account required pam_stack.so service=system-auth<br>
> password required pam_stack.so service=system-auth<br>
> session sufficient pam_stack.so service=tacacs<br>
> session required pam_stack.so service=system-auth<br>
> session required pam_limits.so<br>
> session optional pam_console.so<br>
> <br>
> <br>
> Tacacs+ is not authenticating the credentials.... <br>
> <br>
> /var/log/messages on Tacacs+ Server shows :<br>
> <br>
> Jun 26 11:48:15 netmgr tac_plus[28248]: Version F4.0.4.10 Initialized
1<br>
> Jun 26 11:48:30 netmgr tac_plus[28258]: connect from 10.115.111.215
<br>
> [10.115.111.215]<br>
> Jun 26 11:48:30 netmgr tac_plus[28258]: pap-login query for 'chetan'
ssh <br>
> from 10.115.111.215 rejected<br>
> <br>
> <br>
> Can you help me what could be the issue......<br>
<br>
start with enabling authentication debugging on the tacacs daemon. it
should<br>
tell you why the login failed.<br>
</font></tt>
<br>
<br>
<br>
<br>
<span style="font-family:serif; font-size:8pt; color:#000080">-----------------------------------</span><br>
<span style="font-family:serif; font-size:8pt; color:#000080">This message contains information that may be confidential and proprietary. Unless you are the intended recipient (or authorized to receive this message for the intended recipient), you may not use, copy, disseminate or disclose to anyone the message or any information contained in the message. If you have received the message in error, please advise the sender by reply e-mail, and delete the message immediately. Thank you very much.</span>