<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Almost there guys… </div>
<div><br>
</div>
<div>So I’ve followed all the online guides of how to setup f5 with TAC+. In fact, I’ve done this probably a dozen times with f5 LTM running 11.4.x. These particular f5s all have 11.6.x on them. Not sure if that makes a difference.</div>
<div><br>
</div>
<div>My tac_plus.conf looks like this:</div>
<div><br>
</div>
<div>group = admin</div>
<div>
<div> service = ppp protocol = ip</div>
<div> F5-LTM-User-Info-1 = adm</div>
<div> }</div>
</div>
<div>
<div>user = matta-user {</div>
<div> default service = permit</div>
<div> name = "Matt Almgren"</div>
<div> member = admin</div>
<div> #login = PAM</div>
</div>
<div>}</div>
<div><br>
</div>
<div>I’ve setup the f5 to use tacacs with service=ppp, protocol =ip. I’ve triple-checked the shared key (and as shown below, its fine). I’ve created a remote role with the above attribute string with Administrator and tmsh rights.</div>
<div><br>
</div>
<div>I see this on the f5 /var/log/audit logs:</div>
<div><br>
</div>
<div>
<div>Apr 7 15:10:15 lb-foo err sshd[28512]: pam_tacplus: auth failed: Login incorrect</div>
<div>Apr 7 15:10:15 lb-foo alert sshd[28512]: pam_unix(sshd:auth): check pass; user unknown</div>
<div>Apr 7 15:10:15 lb-foo notice sshd[28512]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.1.1</div>
</div>
<div><br>
</div>
<div>And I can’t login. Even disabling PAM and using DES keys (which always works) doesn’t seem to work here.</div>
<div><br>
</div>
<div>HOWEVER, I have gotten it to work, by adding this to the tac_plus.conf user stanza:</div>
<div><br>
</div>
<div>
<div>login = cleartext "abc123"</div>
<div>pap = cleartext “abc123"</div>
</div>
<div><br>
</div>
<div>So something with PAP works… But I want to use PAM and LDAP and not store passwords in the config file, let alone in cleartext! How can I fix this and make it work correctly? </div>
<div><br>
</div>
<div>Thanks for all the help…almost done with this deployment. :) </div>
<div><br>
</div>
<div> — Matt</div>
<div><br>
</div>
<div>
<div>
<div>
<div><br>
</div>
<div><br>
</div>
<div>-- </div>
<div>Matt Almgren, Sr. Networking Engineer</div>
</div>
<div><img width="207" height="31" id="Picture_x0020_1" src="cid:B8AAD21C-18EC-4AC3-A9DC-C42EC6A66147" alt="SurveyMonkeyLogo011310" type="image/png" style="color: rgb(31, 73, 125); font-size: 15px;"></div>
<div><span style="color: rgb(79, 98, 40); font-family: Arial, sans-serif; font-size: 13px;">101 Lytton Ave., Palo Alto. CA 94301</span></div>
<div style="font-family: Calibri; font-size: medium;">matta@surveymonkey.com</div>
<div style="font-family: Calibri; font-size: medium;">408.499.9669</div>
</div>
</div>
<div><br>
</div>
<div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
</div>
</body>
</html>