<div dir="ltr">Hint: <span style="background-color:rgb(249,249,249);color:rgb(0,0,0);line-height:1.1em">aaa accounting commands ....</span><div><br></div><div>Not sure why you are using cutom priv levels rather than authorization</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Apr 14, 2014 at 8:55 AM, Alan McKinnon <span dir="ltr"><<a href="mailto:alan.mckinnon@gmail.com" target="_blank">alan.mckinnon@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 14/04/2014 16:38, Munroe Sollog wrote:<br>
> I am using accounting. The behavior though is a bit confusing to me. For example, the user<br>
> 'luser' has the following stanza in the tac_plus.conf:<br>
><br>
> user = luser {<br>
> default service = permit<br>
> login = file /usr/local/etc/tac_passwd_file<br>
> service = exec {<br>
> priv-lvl = 2<br>
> }<br>
> cmd = show {<br>
> permit .*<br>
> }<br>
> }<br>
><br>
> The following is an excerpt from the accounting log as well as the actual switch session. As you<br>
> can see the first time I try 'conf t' nothing is logged, when I am still priv-lvl 2 and run 'show<br>
> interface status' nothing is logged. However, after I 'enable' (typoed the password the first<br>
> time) and then run a 'do show interface status' then it is logged. I'm wondering why isn't my<br>
> 'show interface status' logged the first time.<br>
><br>
><br>
> ====tacacs accounting log====<br>
><br>
> Apr 14 10:30:46 192.168.1.126 luser tty2 192.168.1.76 start task_id=334 timezone=UTC<br>
> service=shell start_time=1397485846<br>
> Apr 14 10:31:01 192.168.1.126 luser tty2 192.168.1.76 stop task_id=334 timezone=UTC<br>
> service=shell start_time=1397485861 priv-lvl=0 cmd=enable <cr><br>
> Apr 14 10:31:07 192.168.1.126 luser tty2 192.168.1.76 stop task_id=335 timezone=UTC<br>
> service=shell start_time=1397485867 priv-lvl=0 cmd=enable <cr><br>
> Apr 14 10:31:12 192.168.1.126 luser tty2 192.168.1.76 stop task_id=336 timezone=UTC<br>
> service=shell start_time=1397485872 priv-lvl=15 cmd=configure terminal <cr><br>
> Apr 14 10:31:16 192.168.1.126 luser tty2 192.168.1.76 stop task_id=337 timezone=UTC<br>
> service=shell start_time=1397485876 priv-lvl=15 cmd=do sho interface status <cr><br>
><br>
><br>
><br>
><br>
> =======switch session=====<br>
> $ ssh <a href="mailto:luser@192.168.1.126">luser@192.168.1.126</a><br>
> Password:<br>
><br>
> Switch#show interface status<br>
><br>
> Port Name Status Vlan Duplex Speed Type<br>
> Gi0/1 this is int 1 connected 1 a-full a-1000 10/100/1000BaseTX<br>
> Gi0/2 notconnect 1 auto auto 10/100/1000BaseTX<br>
> Gi0/3 notconnect 1 auto auto 10/100/1000BaseTX<br>
> Gi0/4 notconnect 1 auto auto 10/100/1000BaseTX<br>
> Gi0/5 notconnect 1 auto auto 10/100/1000BaseTX<br>
> Gi0/6 notconnect 1 auto auto 10/100/1000BaseTX<br>
> Gi0/7 notconnect 1 auto auto 10/100/1000BaseTX<br>
> Gi0/8 connected 1 a-full a-1000 10/100/1000BaseTX<br>
> Switch#conf t<br>
> ^<br>
> % Invalid input detected at '^' marker.<br>
><br>
> Switch#enable<br>
> Password:<br>
> % Error in authentication.<br>
><br>
> Switch#enable<br>
> Password:<br>
> Switch#conf t<br>
> Enter configuration commands, one per line. End with CNTL/Z.<br>
> Switch(config)#do sho interface status<br>
><br>
> Port Name Status Vlan Duplex Speed Type<br>
> Gi0/1 this is int 1 connected 1 a-full a-1000 10/100/1000BaseTX<br>
> Gi0/2 notconnect 1 auto auto 10/100/1000BaseTX<br>
> Gi0/3 notconnect 1 auto auto 10/100/1000BaseTX<br>
> Gi0/4 notconnect 1 auto auto 10/100/1000BaseTX<br>
> Gi0/5 notconnect 1 auto auto 10/100/1000BaseTX<br>
> Gi0/6 notconnect 1 auto auto 10/100/1000BaseTX<br>
> Gi0/7 notconnect 1 auto auto 10/100/1000BaseTX<br>
> Gi0/8 connected 1 a-full a-1000 10/100/1000BaseTX<br>
> Switch(config)#<br>
<br>
<br>
</div></div>If a command isn't being logged in the accounting logs it's because the<br>
router never sent it to the tacacs server to be logged; if the router<br>
does send it then tac_plus will log it. You can verify this by enabling<br>
accounting debugging, check the tac_plus man page for the -d option<br>
<br>
Examine closely your AAA settings on the router to see how accounting is<br>
set up there.<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
Alan McKinnon<br>
<a href="mailto:alan.mckinnon@gmail.com">alan.mckinnon@gmail.com</a><br>
</font></span><div class="HOEnZb"><div class="h5"><br>
_______________________________________________<br>
tac_plus mailing list<br>
<a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a><br>
<a href="http://www.shrubbery.net/mailman/listinfo/tac_plus" target="_blank">http://www.shrubbery.net/mailman/listinfo/tac_plus</a><br>
</div></div></blockquote></div><br></div>
<pre>
E-Mail to and from me, in connection with the transaction
of public business, is subject to the Wyoming Public Records
Act and may be disclosed to third parties.