<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jun 17, 2014 at 2:31 PM, Daniel Schmidt <span dir="ltr"><<a href="mailto:daniel.schmidt@wyo.gov" target="_blank">daniel.schmidt@wyo.gov</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I've never had a Alcatel Lucent switch to test. I'm not sure what options it sends; getopt does not correctly parse missing fields. (hence the -fix_crs_bug option) When I get time, I need to iterate through sys.argv[1:] and remove any blank options. </div>
</blockquote><div><br></div><div>yes Alcatel lucent does not generate any log, not even DEBUG log when I login to router unlike cisco.</div><div><br></div><div>It starts logging only when I start typing on the router after the login, and / or when I exit or logout of the</div>
<div>router.</div><div><br></div><div>I can collect some debug log for you to parse. What debug level log you need with tac_plus? I usually</div><div>use "-d 8 -d 16", but I can add more levels. I can provide some log tonight when they are not busy.</div>
<div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="gmail_extra"><br><br><div class="gmail_quote"><div><div class="h5">On Mon, Jun 16, 2014 at 1:30 PM, Asif Iqbal <span dir="ltr"><<a href="mailto:vadud3@gmail.com" target="_blank">vadud3@gmail.com</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
<div>On Mon, Jun 16, 2014 at 3:02 PM, Aaron Wasserott <<br>
<a href="mailto:aaron.wasserott@viawest.com" target="_blank">aaron.wasserott@viawest.com</a>> wrote:<br>
<br>
> In both do_auth.ini and tac_plus.conf be sure to spell the special<br>
> username as "DEFAULT" - minding the upper-case.<br>
><br>
> Do you have any log entries for that failed attempt in<br>
> /root/do_auth/do_auth.log?<br>
><br>
<br>
</div>2014-06-16 16:54:30,195 [CRITICAL]: Did you forget "default service =<br>
permit" in tac_plus.conf?<br>
<br>
That was if I did not have "default service = permit" in the doauthaccess<br>
group.<br>
<div><br>
<br>
> Does your group doauthaccess have the same settings as the other regular<br>
> group, other than the addition of after auth?<br>
><br>
<br>
</div>Yes<br>
<div><br>
<br>
<br>
><br>
> What device type did you test against? I would test against Cisco IOS to<br>
> start with until you get it working.<br>
><br>
><br>
</div>Alcatel Lucent.<br>
<br>
OK let me try against cisco<br>
<div><br>
<br>
<br>
> You also might want to try toggling off the "-fix_crs_bug" flag and test<br>
> login against IOS just to be safe. I've not used that flag before<br>
> personally.<br>
><br>
><br>
</div>OK<br>
<br>
Thanks<br>
<div><div><br>
<br>
<br>
> -----Original Message-----<br>
> From: tac_plus [mailto:<a href="mailto:tac_plus-bounces@shrubbery.net" target="_blank">tac_plus-bounces@shrubbery.net</a>] On Behalf Of Asif<br>
> Iqbal<br>
> Sent: Sunday, June 15, 2014 5:09 PM<br>
> To: <a href="mailto:tac_plus@shrubbery.net" target="_blank">tac_plus@shrubbery.net</a><br>
> Subject: [tac_plus] Need help with do_auth config<br>
><br>
> Let me know if there is a separate mailing list for do_auth related<br>
> questions.<br>
><br>
> So I am trying to follow the do_auth.ini syntax and need some help.<br>
><br>
> I have setup the config file like below and failing to authorize.<br>
><br>
> Here is the do_auth.ini file<br>
><br>
> [users]<br>
> default =<br>
> noprivs<br>
> foo =<br>
> newgroup<br>
><br>
> [newgroup]<br>
> host_allow =<br>
> .*<br>
> command_permit =<br>
> show configuration.*<br>
> device_permit =<br>
> .*<br>
><br>
> [noprivs]<br>
> host_deny =<br>
> .*<br>
> device_deny =<br>
> .*<br>
> command_deny =<br>
> .*<br>
><br>
> Here is the error message<br>
><br>
> Username: iqbala<br>
> Password:<br>
> % Authorization failed.<br>
> Connection closed by foreign host.<br>
><br>
><br>
> Here is the relevant part in tacacs.conf<br>
><br>
> group = doauthaccess {<br>
> after authorization "/usr/bin/python /root/do_auth/do_auth.pyc -i<br>
> $address -fix_crs_bug -u $user -d $name -l /root/do_auth/do_auth.log -f<br>
> /root/do_auth/do_auth.ini"<br>
> }<br>
><br>
> user = foo {<br>
> login = PAM<br>
> member = doauthaccess<br>
> }<br>
><br>
> If I change the member to another group which is regular group and not<br>
> using after authorization, user ``foo'' can login fine.<br>
><br>
> I must not do doing something right.<br>
><br>
> Please advise.<br>
><br>
><br>
><br>
><br>
> --<br>
> Asif Iqbal<br>
> PGP Key: 0xE62693C5 KeyServer: <a href="http://pgp.mit.edu" target="_blank">pgp.mit.edu</a><br>
> A: Because it messes up the order in which people normally read text.<br>
> Q: Why is top-posting such a bad thing?<br>
> -------------- next part --------------<br>
> An HTML attachment was scrubbed...<br>
> URL: <<br>
> <a href="http://www.shrubbery.net/pipermail/tac_plus/attachments/20140615/69fb3916/attachment.html" target="_blank">http://www.shrubbery.net/pipermail/tac_plus/attachments/20140615/69fb3916/attachment.html</a><br>
> ><br>
> _______________________________________________<br>
> tac_plus mailing list<br>
> <a href="mailto:tac_plus@shrubbery.net" target="_blank">tac_plus@shrubbery.net</a><br>
> <a href="http://www.shrubbery.net/mailman/listinfo/tac_plus" target="_blank">http://www.shrubbery.net/mailman/listinfo/tac_plus</a><br>
><br>
<br>
<br>
<br>
--<br>
Asif Iqbal<br>
PGP Key: 0xE62693C5 KeyServer: <a href="http://pgp.mit.edu" target="_blank">pgp.mit.edu</a><br>
A: Because it messes up the order in which people normally read text.<br>
Q: Why is top-posting such a bad thing?<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
</div></div></div></div>URL: <<a href="http://www.shrubbery.net/pipermail/tac_plus/attachments/20140616/ba90c9e1/attachment.html" target="_blank">http://www.shrubbery.net/pipermail/tac_plus/attachments/20140616/ba90c9e1/attachment.html</a>><div class="">
<br>
<div><div>_______________________________________________<br>
tac_plus mailing list<br>
<a href="mailto:tac_plus@shrubbery.net" target="_blank">tac_plus@shrubbery.net</a><br>
<a href="http://www.shrubbery.net/mailman/listinfo/tac_plus" target="_blank">http://www.shrubbery.net/mailman/listinfo/tac_plus</a><br>
</div></div></div></blockquote></div><br></div>
<pre>E-Mail to and from me, in connection with the transaction
of public business, is subject to the Wyoming Public Records
Act and may be disclosed to third parties.
</pre></blockquote></div><br><br clear="all"><div><br></div>-- <br>Asif Iqbal<br>PGP Key: 0xE62693C5 KeyServer: <a href="http://pgp.mit.edu">pgp.mit.edu</a><br>A: Because it messes up the order in which people normally read text.<br>
Q: Why is top-posting such a bad thing?<br><br>
</div></div>