It also does support pap = des <div>so if you have to use pap you can at least crypt the config hardcoded password<br><br><div class="gmail_quote">On Wed, Sep 23, 2009 at 11:04 AM, john heasley <span dir="ltr"><<a href="mailto:heas@shrubbery.net">heas@shrubbery.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Tue, Sep 22, 2009 at 04:28:31PM -0800, Jason Jeremias:<br>
<div class="im">> Oh also I removed all the comments from the config file that's why its<br>
> referencing line 50. It looks to me like it just doesn't like the pap<br>
> = PAM, if I switch to login = PAM it works fine.<br>
<br>
</div>Bad memory; pap auth currently only supports cleartext. glancing at the<br>
code, there is no reason it couldnt be added, just has to be coded.<br>
<div><div></div><div class="h5"><br>
> -J<br>
><br>
> Jason Jeremias wrote:<br>
>> When I run it I get.<br>
>> root@ns02:/usr/local/src/tac_plus_v9a# /usr/local/bin/tac_plus -C<br>
>> /etc/tacacs/tac_plus.cfg -d 16<br>
>> Error: expecting 'cleartext', or 'des' keyword after 'pap =' on line 50<br>
>><br>
>> So to check that I have pam I did a:<br>
>> root@ns02:/usr/local/src/tac_plus_v9a# /usr/local/bin/tac_plus -v<br>
>> tac_plus version F4.0.4.19<br>
>> ACLS<br>
>> FIONBIO<br>
>> LIBWRAP<br>
>> LINUX<br>
>> LITTLE_ENDIAN<br>
>> LOG_DAEMON<br>
>> PAM<br>
>> NO_PWAGE<br>
>> REAPCHILD<br>
>> RETSIGTYPE RETSIGTYPE<br>
>> SHADOW_PASSWORDS<br>
>> SIGTSTP<br>
>> SIGTTIN<br>
>> SIGTTOU<br>
>> SO_REUSEADDR<br>
>> STRERROR<br>
>> TAC_PLUS_PORT<br>
>> UENABLE<br>
>> __STDC__<br>
>><br>
>> This told me that I do indeed have PAM compiled in.<br>
>><br>
>><br>
>> Here's my config file.<br>
>> root@ns02:/usr/local/src/tac_plus_v9a# cat /etc/tacacs/tac_plus.cfg<br>
>><br>
>> key = testing12345<br>
>><br>
>> # Now tacacs+ also use default PAM authentication<br>
>> #default authentication = pap PAM<br>
>><br>
>> # Accounting records log file<br>
>><br>
>> accounting file = /var/log/tac_acc.log<br>
>><br>
>> user = DEFAULT {<br>
>> #service = ppp protocol = lcp { idletime = 15 }<br>
>> #service = ppp protocol = ip {}<br>
>> #pap = PAM<br>
>> #maxsess = 2<br>
>> member = DEFAULT<br>
>> }<br>
>><br>
>> group = DEFAULT {<br>
>> service = ppp protocol = ip {}<br>
>> pap = PAM<br>
>> #maxsess = 2<br>
>> }<br>
>><br>
>><br>
>> root@ns02:/usr/local/src/tac_plus_v9a#<br>
>><br>
>><br>
>><br>
>> john heasley wrote:<br>
>>> Tue, Sep 22, 2009 at 03:26:34PM -0800, Jason Jeremias:<br>
>>><br>
>>>> I downloaded the latest tac_plus software but I can't seem to get<br>
>>>> pap = PAM to work is this possible? I need to authenticate ppp<br>
>>>> uses against pam.<br>
>>>><br>
>>><br>
>>> did you make any effort to use daemon debugging options to debug the<br>
>>> problem that you'd like to mention?<br>
>>><br>
>><br>
><br>
</div></div><div><div></div><div class="h5">_______________________________________________<br>
tac_plus mailing list<br>
<a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a><br>
<a href="http://www.shrubbery.net/mailman/listinfo.cgi/tac_plus" target="_blank">http://www.shrubbery.net/mailman/listinfo.cgi/tac_plus</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Paul Vdovets<br>
</div>