<div dir="ltr">Can you get me a log of that failure? Set debug to True in the code. <div><br></div><div><div>271 DEBUG = os.getenv('DEBUG', <b>True</b>)</div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 24, 2015 at 3:43 PM, Daniel Schmidt <span dir="ltr"><<a href="mailto:daniel.schmidt@wyo.gov" target="_blank">daniel.schmidt@wyo.gov</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hum... certainly doesn't do that on Brocade/Cisco routers/switches. Let me research this a second, Aaron. </div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 24, 2015 at 11:51 AM, Aaron Wasserott <span dir="ltr"><<a href="mailto:aaron.wasserott@viawest.com" target="_blank">aaron.wasserott@viawest.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">I have a Cisco ASR 9000 running 4.3.2 and cannot enter some IPv6 ACL commands when do_auth is enabled for that user. Tac_plus version is F4.0.4.28 and do_auth.py is 1.92<br>
Note: In the examples below I am using invalid addresses, but am trying valid addresses in the actual commands.<br>
<br>
Here is the error we see when do_auth is enabled:<br>
<br>
RP/0/RSP0/CPU0:asr-9010-01(config)#ipv6 access-list test permit ipv6 xx90::/16 any<br>
Command authorization failed<br>
% Incomplete command.<br>
<br>
Here is running that same command w/o do_auth enabled:<br>
<br>
RP/0/RSP0/CPU0:asr-9010-01(config)#ipv6 access-list test permit ipv6 xx90::/16 any<br>
RP/0/RSP0/CPU0:asr-9010-01(config)#commit<br>
Thu Apr 23 09:51:35.413 UTC<br>
RP/0/RSP0/CPU0:asr-9010-01(config)#do sh access-lists ipv6 test<br>
Thu Apr 23 09:52:01.073 UTC<br>
ipv6 access-list test<br>
10 permit ipv6 xx90::/16 any<br>
<br>
At first I thought maybe it was just the double-colons that do_auth doesn't like ....<br>
<br>
Here without IPv6 short-hand and with do_auth enabled:<br>
<br>
RP/0/RSP0/CPU0:asr-9010-01(config)#ipv6 access-list test permit ipv6 xx90:0:0:0:0:0:0:0/128 any<br>
Command authorization failed<br>
% Incomplete command.<br>
RP/0/RSP0/CPU0:asr-9010-01(config)#commit<br>
Thu Apr 23 10:01:45.208 UTC<br>
No configuration changes to commit.<br>
<br>
Here without IPv6 short-hand and and do_auth disabled:<br>
<br>
RP/0/RSP0/CPU0:asr-9010-01(config)#ipv6 access-list test permit ipv6 xx90:0:0:0:0:0:0:0/128 any<br>
RP/0/RSP0/CPU0:asr-9010-01(config)#commit<br>
Thu Apr 23 10:02:30.903 UTC<br>
RP/0/RSP0/CPU0:asr-9010-01(config)#do sh access-lists ipv6 test<br>
Thu Apr 23 10:02:33.440 UTC<br>
ipv6 access-list test<br>
10 permit ipv6 host xx90:: any<br>
<br>
But it appears that it doesn't like any colons in authorization commands. If I enter the ACL with "any any" it works. With do_auth enabled I don't get any hits in the do_auth.log for the failing command.<br>
<br>
This is happening in production, but I have setup a simple lab to play with using very minimal settings, and a fresh install of the daemon installed from source.<br>
<br>
tac_plus version:<br>
<br>
sudo /usr/local/sbin/tac_plus -v<br>
tac_plus version F4.0.4.28<br>
ACLS<br>
FIONBIO<br>
LIBWRAP<br>
LINUX<br>
LITTLE_ENDIAN<br>
LOG_DAEMON<br>
NO_PWAGE<br>
REAPCHILD<br>
REAPSIGIGN<br>
RETSIGTYPE RETSIGTYPE<br>
SHADOW_PASSWORDS<br>
SIGTSTP<br>
SIGTTIN<br>
SIGTTOU<br>
SO_REUSEADDR<br>
STRERROR<br>
TAC_PLUS_PORT<br>
UENABLE<br>
__STDC__<br>
<br>
<br>
Here is my tac_plus.conf file:<br>
<br>
key = password<br>
# password should be "password" for user testuser<br>
default authentication = file /etc/passwd<br>
<br>
group = test {<br>
default service = permit<br>
service = exec {<br>
priv-lvl = 15<br>
}<br>
after authorization "/usr/bin/python /usr/local/bin/do_auth.pyc -i $address -u $user -d $name -l /var/log/do_auth.log -f /etc/tacacs/do_auth.ini"<br>
}<br>
<br>
user = testuser {<br>
member = test<br>
}<br>
<br>
<br>
And my do_auth file:<br>
<br>
DEFAULT =<br>
neteng-group<br>
<br>
[neteng-group]<br>
host_allow =<br>
.*<br>
device_deny =<br>
10.99.0.15<br>
device_permit =<br>
.*<br>
command_permit =<br>
.*<br>
<br>
<br>
And here are AAA commands on the router:<br>
<br>
tacacs-server host 10.11.11.10 port 49<br>
key 7 071F205F5D1E161713<br>
!<br>
aaa group server tacacs+ mytacacs<br>
server 10.11.11.10<br>
!<br>
aaa authorization exec default group mytacacs none<br>
aaa authorization commands default group mytacacs none<br>
aaa authentication login default group mytacacs local<br>
<br>
Thanks!<br>
<br>
-Aaron<br>
This message contains information that may be confidential, privileged or otherwise protected by law from disclosure. It is intended for the exclusive use of the addressee(s). Unless you are the addressee or authorized agent of the addressee, you may not review, copy, distribute or disclose to anyone the message or any information contained within. If you have received this message in error, please contact the sender by electronic reply and immediately delete all copies of the message.<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://www.shrubbery.net/pipermail/tac_plus/attachments/20150424/00b6c868/attachment.html" target="_blank">http://www.shrubbery.net/pipermail/tac_plus/attachments/20150424/00b6c868/attachment.html</a>><br>
_______________________________________________<br>
tac_plus mailing list<br>
<a href="mailto:tac_plus@shrubbery.net" target="_blank">tac_plus@shrubbery.net</a><br>
<a href="http://www.shrubbery.net/mailman/listinfo/tac_plus" target="_blank">http://www.shrubbery.net/mailman/listinfo/tac_plus</a><br>
</blockquote></div><br></div>
</div></div></blockquote></div><br></div>
<br>
<br>E-Mail to and from me, in connection with the transaction <br>of public business, is subject to the Wyoming Public Records <br>Act and may be disclosed to third parties.<br>