<div dir="ltr"><div>Kevin,</div><div><br></div><div>I'm not using defined tacacs+ groups in our configuration so, that is a variable that could be triggering a bug in AAA authorization but, your config is very similar to what we're using:</div><div><br></div><div>!</div><div><div>tacacs-server key 7 <redacted></div><div>tacacs-server host x.x.x.a</div><div>tacacs-server host x.x.x.b</div><div>!</div><div>aaa authentication login default group tacacs+ local</div><div>aaa authentication enable default group tacacs+ local</div><div>aaa authorization exec default group tacacs+ local</div><div>aaa authorization commands all default group tacacs+ none</div><div>aaa accounting exec default start-stop group tacacs+</div><div>aaa accounting system default start-stop group tacacs+</div><div>aaa accounting commands all default stop-only group tacacs+</div></div>!<br><div class="gmail_extra"><br></div><div class="gmail_extra">Please note though that based on what you sent in your original email, your EOS device is not sending AUTH requests for commands. I only see ACCT records being sent:</div><div class="gmail_extra"><br></div><div class="gmail_extra">Here is the AUTH request coming from your Cisco:</div><div class="gmail_extra"><br></div><div class="gmail_extra"><ul style="color:rgb(80,0,80);padding-left:9pt"><font size="2" face="sans-serif">session request from </font><a href="http://test.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>test.router.com</u></font></a><font size="2" face="sans-serif"> sock=5<br>connect from </font><a href="http://test.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>test.router.com</u></font></a><font size="2" face="sans-serif"> [10.11.128.30]<br>Waiting for packet<br><span style="background-color:rgb(255,255,0)">Read AUTHOR size=104</span><br>validation request from </font><a href="http://test.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>test.router.com</u></font></a><font size="2" face="sans-serif"><br>PACKET: key=password<br>version 192 (0xc0), type 2, seq no 1, flags 0x1<br>session_id </font><a href="tel:4255328848" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>4255328848</u></font></a><font size="2" face="sans-serif"> (0xfda32a50), Data length 92 (0x5c)<br>End header<br><span style="background-color:rgb(255,255,0)">type=AUTHOR, priv_lvl=15, authen=1</span><br>method=none<br>svc=0 user_len=6 port_len=6 rem_addr_len=14<br>arg_cnt=4<br>User:<br>testuser<br>port:<br>tty130<br>rem_addr:<br>10.12.144.108<br>arg[0]: size=13<br>service=shell<br>arg[1]: size=13<br>cmd=configure<br>arg[2]: size=16<br>cmd-arg=terminal<br>arg[3]: size=12<br>cmd-arg=<cr><br>End packet<br>Writing AUTHOR/FAIL size=18<br>PACKET: key=password<br>version 192 (0xc0), type 2, seq no 2, flags 0x1<br>session_id </font><a href="tel:4255328848" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>4255328848</u></font></a><font size="2" face="sans-serif"> (0xfda32a50), Data length 6 (0x6)<br>End header<br>type=AUTHOR/REPLY status=16 (AUTHOR/FAIL)<br>msg_len=0, data_len=0 arg_cnt=0<br>msg:<br>data:<br>End packet<br>authorization query for 'testuser' tty130 from </font><a href="http://test.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>test.router.com</u></font></a><font size="2" face="sans-serif"> rejected</font><font size="2" color="#0000FF" face="sans-serif"><u><br></u></font><a href="http://test.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>test.router.com</u></font></a><font size="2" face="sans-serif">: disconnect</font></ul></div><div class="gmail_extra"><br></div><div class="gmail_extra">...vs the ACCT record being sent by the EOS device(s):</div><div class="gmail_extra"><br></div><div class="gmail_extra"><ul style="color:rgb(80,0,80);padding-left:9pt"><font size="2" face="sans-serif">session request from </font><a href="http://aristalab-1.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>Aristalab-1.router.com</u></font></a><font size="2" face="sans-serif"> sock=5<br>connect from </font><a href="http://aristalab-1.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>Aristalab-1.router.com</u></font></a><font size="2" face="sans-serif"> [10.15.10.18]<br>Waiting for packet<br><span style="background-color:rgb(255,255,0)">Read ACCT size=132</span><br>validation request from </font><a href="http://aristalab-1.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>Aristalab-1.router.com</u></font></a><font size="2" face="sans-serif"><br>PACKET: key=password<br>version 192 (0xc0), type 3, seq no 1, flags 0x1<br>session_id 1288212585 (0x4cc89069), Data length 120 (0x78)<br>End header<br><span style="background-color:rgb(255,255,0)">ACCT, flags=0x4 method=6 priv_lvl=15</span><br>type=1 svc=1<br>user_len=6 port_len=5 rem_addr_len=0<br>arg_cnt=6<br>User:<br>testuser<br>port:<br>ttyS0<br>rem_addr:<br>arg[0]: size=10<br>task_id=23<br>arg[1]: size=13<br>service=shell<br>arg[2]: size=11<br>priv-lvl=15<br>arg[3]: size=21<br>start_time=1439828061<br>arg[4]: size=12<br>timezone=UTC<br>arg[5]: size=27<br>cmd=configure terminal <cr><br>End packet<br>Writing ACCT size=17<br>PACKET: key=password<br>version 192 (0xc0), type 3, seq no 2, flags 0x1<br>session_id 1288212585 (0x4cc89069), Data length 5 (0x5)<br>End header<br>ACCT/REPLY status=1<br>msg_len=0 data_len=0<br>msg:<br>data:<br>End packet</font><font size="2" color="#0000FF" face="sans-serif"><u><br></u></font><a href="http://aristalab-1.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>Aristalab-1.router.com</u></font></a><font size="2" face="sans-serif">: disconnect</font><font size="2" face="sans-serif"><ul style="color:rgb(80,0,80);padding-left:9pt"><font size="2" face="sans-serif"><br></font></ul></font></ul></div><div class="gmail_extra"><br></div><div class="gmail_extra">So, in effect, where the Cisco device is asking permission to execute the command, the EOS device is simply informing the TACACS+ server that the command was executed. It's a matter of ACCOUNT vs AUTHORIZE.</div><div class="gmail_extra"><br></div><div class="gmail_extra">You might want to update your ticket with Arista to include that information. You may also want to try enumerating your TACACS+ servers the way I have vs. using a AAA group just to rule that variable out as the vector that is triggering a bug. I understand that if you've got a large EOS deployment, it is non-trivial to push AAA config changes to them all but, trust me - it can be done. I've got a fleet > 2000 EOS devices and I just updated their AAA config a few weeks ago.</div><div class="gmail_extra"><br></div><div class="gmail_extra">The safest way to do it would be as follows:</div><div class="gmail_extra"><br></div><div class="gmail_extra">(1) Enumerate the TACACS+ servers outside of the group:</div><div class="gmail_extra">!</div><div class="gmail_extra"><div>tacacs-server key 7 <redacted></div><div>tacacs-server host x.x.x.a</div><div>tacacs-server host x.x.x.b</div></div><div class="gmail_extra">!</div><div class="gmail_extra">Then, update your aaa auth commands as follows:</div><div class="gmail_extra"><br></div><div class="gmail_extra">!</div><div class="gmail_extra"><div>aaa authorization exec default group tacacs+ local</div><div>aaa authorization commands all default group tacacs+ none</div><div>!</div><div><br></div><div>Please let me know if this helps and also update me if Arista identifies a bug. That's information I'd like to have in our "tribal knowledge" store.</div><div><br></div><div><br></div></div><div class="gmail_extra"><div><div class="gmail_signature"><div dir="ltr"><div>--</div>John Fraizer<div>LinkedIn profile: <a href="http://www.linkedin.com/in/johnfraizer/" target="_blank">http://www.linkedin.com/in/johnfraizer/</a></div><div><br><div><span style="color:rgb(53,53,53);font-family:Arial,sans-serif;font-size:12px;line-height:12px;background-color:rgb(244,244,244)"><br></span></div></div></div></div></div>
<br><div class="gmail_quote">On Mon, Aug 17, 2015 at 2:03 PM, <span dir="ltr"><<a href="mailto:Kevin.Cruse@instinet.com" target="_blank">Kevin.Cruse@instinet.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><p><font size="2" face="sans-serif">John,</font><br><br><font size="2" face="sans-serif">Here is the configuration from arista:</font><span class=""><br><br><font size="2" face="sans-serif">Arista1#sh run | i aaa</font><br><font size="2" face="sans-serif">aaa group server tacacs+ CiscoACS</font><br><font size="2" face="sans-serif">aaa authentication login default group CiscoACS local</font><br><font size="2" face="sans-serif">aaa authorization exec default group CiscoACS local</font><br><font size="2" face="sans-serif">aaa authorization commands all default group CiscoACS local</font><br><font size="2" face="sans-serif">aaa accounting exec default start-stop group CiscoACS</font><br><font size="2" face="sans-serif">aaa accounting commands all default start-stop group CiscoACS</font><br><font size="2" face="sans-serif">no aaa root</font><br></span><font size="2" face="sans-serif">Arista1#</font><br><br><br><font size="2" face="sans-serif">Just fyi - I've configured the command "#aaa authorization config-commands" as well, for some reason it does not show up in configuration. I opened a ticket with arista and they've confirmed it should still work which makes sense as i'm seeing the commands sent to tacplus.</font><br><br><br><font size="2" face="sans-serif">Arista1#sh ver</font><br><font size="2" face="sans-serif">Arista DCS-7124SX-F</font><br><font size="2" face="sans-serif">Software image version: 4.13.11M</font><br><br><br><font size="2" face="sans-serif">Kevin</font><br><br><br><br><br><br><img width="16" height="16" src="cid:1__=0ABBF437DFF169458f9e@AMERICAS.CORP.LOCAL" border="0" alt="Inactive hide details for John Fraizer ---08/17/2015 12:58:52 PM---What version of EOS are you running on your Arista device(s)"><font size="2" color="#424282" face="sans-serif">John Fraizer ---08/17/2015 12:58:52 PM---What version of EOS are you running on your Arista device(s)? Take a look at the "tab completion" av</font><span class=""><br><br><font size="1" color="#5F5F5F" face="sans-serif">From: </font><font size="1" face="sans-serif">John Fraizer <<a href="mailto:john@op-sec.us" target="_blank">john@op-sec.us</a>></font><br><font size="1" color="#5F5F5F" face="sans-serif">To: </font><font size="1" face="sans-serif">"Kevin.Cruse@Instinet.com" <<a href="mailto:Kevin.Cruse@instinet.com" target="_blank">Kevin.Cruse@instinet.com</a>>, </font><br><font size="1" color="#5F5F5F" face="sans-serif">Cc: </font><font size="1" face="sans-serif">Daniel Schmidt <<a href="mailto:daniel.schmidt@wyo.gov" target="_blank">daniel.schmidt@wyo.gov</a>>, "<a href="mailto:tac_plus@shrubbery.net" target="_blank">tac_plus@shrubbery.net</a>" <<a href="mailto:tac_plus@shrubbery.net" target="_blank">tac_plus@shrubbery.net</a>></font><br></span><font size="1" color="#5F5F5F" face="sans-serif">Date: </font><font size="1" face="sans-serif">08/17/2015 12:58 PM</font></p><div><div class="h5"><br><font size="1" color="#5F5F5F" face="sans-serif">Subject: </font><font size="1" face="sans-serif">Re: [tac_plus] Cisco Nexus Authorization problem</font><br><hr width="100%" size="2" align="left" noshade style="color:#8091a5"><br><br><br><font size="3" face="serif">What version of EOS are you running on your Arista device(s)?</font><br><br><font size="3" face="serif">Take a look at the "tab completion" available for "aaa authorization". Also, if you can provide the output of "show run | i aaa", it will be easier to help you.</font><br><br><font size="3" face="serif">Initially, it looks as if your Arista devices are not configure to authorize commands. Note that the packet dump shows "ACCT" type for "enable" and "configure terminal" vs. "AUTHOR".</font><br><br><font size="3" face="serif">--</font><br><font size="3" face="serif">John Fraizer</font><br><font size="3" face="serif">LinkedIn profile: </font><a href="http://www.linkedin.com/in/johnfraizer/" target="_blank"><font size="3" color="#0000FF" face="serif"><u>http://www.linkedin.com/in/johnfraizer/</u></font></a><br><br><br><br><font size="3" face="serif">On Mon, Aug 17, 2015 at 12:21 PM, <</font><a href="mailto:Kevin.Cruse@instinet.com" target="_blank"><font size="3" color="#0000FF" face="serif"><u>Kevin.Cruse@instinet.com</u></font></a><font size="3" face="serif">> wrote:</font><ul style="padding-left:9pt"><font size="2" face="sans-serif">I am having a strange issue where cisco devices are being authorized by do_auth properly, however, arista devices are not. The arista device is sending command to tacplus but daemont does not send command to do_auth. I can confirm since there is no update to do_auth log when sending commands from arista. any ideas? Everything seems to be working fine except arista, this is my last hurdle! </font><font size="3" face="serif"><br><br></font><font size="2" face="sans-serif"><br>CISCO</font><font size="3" face="serif"><br></font><font size="2" face="sans-serif"><br>connect from </font><a href="http://test.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>test.router.com</u></font></a><font size="2" face="sans-serif"> [10.11.128.30]<br>Waiting for packet<br>Read ACCT size=137<br>validation request from </font><a href="http://test.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>test.router.com</u></font></a><font size="2" face="sans-serif"><br>PACKET: key=password<br>version 192 (0xc0), type 3, seq no 1, flags 0x1<br>session_id 677254324 (0x285e14b4), Data length 125 (0x7d)<br>End header<br>ACCT, flags=0x4 method=6 priv_lvl=1<br>type=1 svc=1<br>user_len=6 port_len=6 rem_addr_len=14<br>arg_cnt=6<br>User:<br>testuser<br>port:<br>tty130<br>rem_addr:<br>10.12.144.108<br>arg[0]: size=13<br>task_id=41325<br>arg[1]: size=12<br>timezone=EDT<br>arg[2]: size=13<br>service=shell<br>arg[3]: size=21<br>start_time=1439827839<br>arg[4]: size=10<br>priv-lvl=0<br>arg[5]: size=15<br>cmd=enable <cr><br>End packet<br>Writing ACCT size=17<br>PACKET: key=password<br>version 192 (0xc0), type 3, seq no 2, flags 0x1<br>session_id 677254324 (0x285e14b4), Data length 5 (0x5)<br>End header<br>ACCT/REPLY status=1<br>msg_len=0 data_len=0<br>msg:<br>data:<br>End packet</font><font size="2" color="#0000FF" face="sans-serif"><u><br></u></font><a href="http://test.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>test.router.com</u></font></a><font size="2" face="sans-serif">: disconnect</font><font size="3" face="serif"><br><br></font><font size="2" face="sans-serif"><br>session request from </font><a href="http://test.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>test.router.com</u></font></a><font size="2" face="sans-serif"> sock=5<br>connect from </font><a href="http://test.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>test.router.com</u></font></a><font size="2" face="sans-serif"> [10.11.128.30]<br>Waiting for packet<br>Read AUTHOR size=104<br>validation request from </font><a href="http://test.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>test.router.com</u></font></a><font size="2" face="sans-serif"><br>PACKET: key=password<br>version 192 (0xc0), type 2, seq no 1, flags 0x1<br>session_id </font><a href="tel:4255328848" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>4255328848</u></font></a><font size="2" face="sans-serif"> (0xfda32a50), Data length 92 (0x5c)<br>End header<br>type=AUTHOR, priv_lvl=15, authen=1<br>method=none<br>svc=0 user_len=6 port_len=6 rem_addr_len=14<br>arg_cnt=4<br>User:<br>testuser<br>port:<br>tty130<br>rem_addr:<br>10.12.144.108<br>arg[0]: size=13<br>service=shell<br>arg[1]: size=13<br>cmd=configure<br>arg[2]: size=16<br>cmd-arg=terminal<br>arg[3]: size=12<br>cmd-arg=<cr><br>End packet<br>Writing AUTHOR/FAIL size=18<br>PACKET: key=password<br>version 192 (0xc0), type 2, seq no 2, flags 0x1<br>session_id </font><a href="tel:4255328848" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>4255328848</u></font></a><font size="2" face="sans-serif"> (0xfda32a50), Data length 6 (0x6)<br>End header<br>type=AUTHOR/REPLY status=16 (AUTHOR/FAIL)<br>msg_len=0, data_len=0 arg_cnt=0<br>msg:<br>data:<br>End packet<br>authorization query for 'testuser' tty130 from </font><a href="http://test.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>test.router.com</u></font></a><font size="2" face="sans-serif"> rejected</font><font size="2" color="#0000FF" face="sans-serif"><u><br></u></font><a href="http://test.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>test.router.com</u></font></a><font size="2" face="sans-serif">: disconnect</font><font size="3" face="serif"><br><br></font><font size="2" face="sans-serif"><br>ARISTA</font><font size="3" face="serif"><br></font><font size="2" face="sans-serif"><br>connect from </font><a href="http://aristalab-1.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>Aristalab-1.router.com</u></font></a><font size="2" face="sans-serif"> [10.15.10.18]<br>Waiting for packet<br>Read ACCT size=119<br>validation request from </font><a href="http://aristalab-1.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>Aristalab-1.router.com</u></font></a><font size="2" face="sans-serif"><br>PACKET: key=password<br>version 192 (0xc0), type 3, seq no 1, flags 0x1<br>session_id 1744489531 (0x67facc3b), Data length 107 (0x6b)<br>End header<br>ACCT, flags=0x4 method=6 priv_lvl=1<br>type=1 svc=1<br>user_len=6 port_len=5 rem_addr_len=0<br>arg_cnt=6<br>User:<br>testuser<br>port:<br>ttyS0<br>rem_addr:<br>arg[0]: size=10<br>task_id=22<br>arg[1]: size=13<br>service=shell<br>arg[2]: size=10<br>priv-lvl=1<br>arg[3]: size=21<br>start_time=1439828055<br>arg[4]: size=12<br>timezone=UTC<br>arg[5]: size=15<br>cmd=enable <cr><br>End packet<br>Writing ACCT size=17<br>PACKET: key=password<br>version 192 (0xc0), type 3, seq no 2, flags 0x1<br>session_id 1744489531 (0x67facc3b), Data length 5 (0x5)<br>End header<br>ACCT/REPLY status=1<br>msg_len=0 data_len=0<br>msg:<br>data:<br>End packet</font><font size="2" color="#0000FF" face="sans-serif"><u><br></u></font><a href="http://aristalab-1.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>Aristalab-1.router.com</u></font></a><font size="2" face="sans-serif">: disconnect</font><font size="3" face="serif"><br><br></font><font size="2" face="sans-serif"><br>session request from </font><a href="http://aristalab-1.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>Aristalab-1.router.com</u></font></a><font size="2" face="sans-serif"> sock=5<br>connect from </font><a href="http://aristalab-1.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>Aristalab-1.router.com</u></font></a><font size="2" face="sans-serif"> [10.15.10.18]<br>Waiting for packet<br>Read ACCT size=132<br>validation request from </font><a href="http://aristalab-1.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>Aristalab-1.router.com</u></font></a><font size="2" face="sans-serif"><br>PACKET: key=password<br>version 192 (0xc0), type 3, seq no 1, flags 0x1<br>session_id 1288212585 (0x4cc89069), Data length 120 (0x78)<br>End header<br>ACCT, flags=0x4 method=6 priv_lvl=15<br>type=1 svc=1<br>user_len=6 port_len=5 rem_addr_len=0<br>arg_cnt=6<br>User:<br>testuser<br>port:<br>ttyS0<br>rem_addr:<br>arg[0]: size=10<br>task_id=23<br>arg[1]: size=13<br>service=shell<br>arg[2]: size=11<br>priv-lvl=15<br>arg[3]: size=21<br>start_time=1439828061<br>arg[4]: size=12<br>timezone=UTC<br>arg[5]: size=27<br>cmd=configure terminal <cr><br>End packet<br>Writing ACCT size=17<br>PACKET: key=password<br>version 192 (0xc0), type 3, seq no 2, flags 0x1<br>session_id 1288212585 (0x4cc89069), Data length 5 (0x5)<br>End header<br>ACCT/REPLY status=1<br>msg_len=0 data_len=0<br>msg:<br>data:<br>End packet</font><font size="2" color="#0000FF" face="sans-serif"><u><br></u></font><a href="http://aristalab-1.router.com/" target="_blank"><font size="2" color="#0000FF" face="sans-serif"><u>Aristalab-1.router.com</u></font></a><font size="2" face="sans-serif">: disconnect</font><font size="3" face="serif"><br><br></font><font size="2" face="sans-serif"><br>tac_plus.cfg:</font><font size="3" face="serif"><br><br></font><font size="2" face="sans-serif"><br> group = snm {<br> default service = permit<br> service = exec {<br> priv-lvl = 15<br> }<br> after authorization "/usr/bin/python /usr/local/sbin/tacplus/do_auth.py -i $address -fix_crs_bug -u $user -d $name -l /var/log/tacacs/do_auth_log.txt -f /usr/local/sbin/tacplus/do_auth.ini"</font><font size="3" face="serif"><br></font><font size="2" face="sans-serif"><br> }</font><font size="3" face="serif"><br><br><br></font><font size="2" face="sans-serif"><br>do_auth.ini:</font><font size="3" face="serif"><br><br></font><font size="2" face="sans-serif"><br>[snm]<br>host_allow =<br> .*<br>device_permit =<br> .*<br>command_deny =<br> configure.*<br> show controllers vip.*<br>command_permit =<br> show ip.*<br> show interface.*<br> clear counters.*<br> clear qos stat.*<br> clear mls qos int.*<br> disable.*<br> enable.*<br> end.*<br> exit.*<br> logout.*<br> ping.*<br> set length.*<br> show.*<br> skip-page-display.*<br> write network.*<br> write terminal.*<br> write memory.*<br> terminal length.*</font><font size="3" face="serif"><br><br><br><br><br><br></font><img src="cid:1__=0ABBF437DFF169458f9e@AMERICAS.CORP.LOCAL" width="16" height="16" alt="Inactive hide details for John Fraizer ---08/07/2015 12:54:36 PM---Here is one problem: *cmd exit does not exist, denied by def"><font size="2" color="#424282" face="sans-serif">John Fraizer ---08/07/2015 12:54:36 PM---Here is one problem: *cmd exit does not exist, denied by default*</font><font size="3" face="serif"><br></font><font size="1" color="#5F5F5F" face="sans-serif"><br>From: </font><font size="1" face="sans-serif">John Fraizer <</font><a href="mailto:john@op-sec.us" target="_blank"><font size="1" color="#0000FF" face="sans-serif"><u>john@op-sec.us</u></font></a><font size="1" face="sans-serif">></font><font size="1" color="#5F5F5F" face="sans-serif"><br>To: </font><font size="1" face="sans-serif">"Kevin.Cruse@Instinet.com" <</font><a href="mailto:Kevin.Cruse@instinet.com" target="_blank"><font size="1" color="#0000FF" face="sans-serif"><u>Kevin.Cruse@instinet.com</u></font></a><font size="1" face="sans-serif">>, </font><font size="1" color="#5F5F5F" face="sans-serif"><br>Cc: </font><font size="1" face="sans-serif">Daniel Schmidt <</font><a href="mailto:daniel.schmidt@wyo.gov" target="_blank"><font size="1" color="#0000FF" face="sans-serif"><u>daniel.schmidt@wyo.gov</u></font></a><font size="1" face="sans-serif">>, "</font><a href="mailto:tac_plus@shrubbery.net" target="_blank"><font size="1" color="#0000FF" face="sans-serif"><u>tac_plus@shrubbery.net</u></font></a><font size="1" face="sans-serif">" <</font><a href="mailto:tac_plus@shrubbery.net" target="_blank"><font size="1" color="#0000FF" face="sans-serif"><u>tac_plus@shrubbery.net</u></font></a><font size="1" face="sans-serif">></font><font size="1" color="#5F5F5F" face="sans-serif"><br>Date: </font><font size="1" face="sans-serif">08/07/2015 12:54 PM</font><p><font size="1" color="#5F5F5F" face="sans-serif"><br>Subject: </font><font size="1" face="sans-serif">Re: [tac_plus] Cisco Nexus Authorization problem</font><font size="3" face="serif"><br></font></p><hr width="100%" size="2" align="left" noshade><font size="3" face="serif"><br><br><br>Here is one problem:<br></font><font size="3" face="serif"><b><br>cmd exit does not exist, denied by default</b></font><font size="3" face="serif"><br><br>It looks like you've got default service = deny in your tac_plus.conf. To use do_auth, you need default service = permit.<br><br>Your after auth line doesn't look right either.<br></font><font size="3" face="serif"><b><br>/usr/bin/python /usr/local/sbin/tacplus/do_auth.py -u $user -l /var/log/tacacs/do_auth_log.txt -f /usr/local/sbin/tacplus/do_auth.ini</b></font><font size="3" face="serif"><br><br>You're not giving it the device address or the address of the user attempting to auth. Try changing the after authorization line in tac_plus.conf to:<br></font><font size="3" face="serif"><b><br>after authorization "/usr/bin/python /usr/local/sbin/tacplus/do_auth.py -i $address -u $user -d $name -l /tmp/do_auth.log -f /usr/local/sbin/tacplus/do_auth.ini"</b></font><font size="3" face="serif"><br><br>Note that this will create a do_auth specific log in /tmp/do_auth.log but, right now - we'll need that for debugging purposes.<br><br>Also remember, you'll need to restart tac_plus for this change to take effect.<br><br>Here is an example tac_plus group that I know to work properly with do_auth.py on CatOS, IOS, IOS-XR, NX-OS, EOS and JUNOS:<br><br>group = doauthaccess {<br> default service = permit<br><br> service = exec {<br> priv-lvl = 1<br> optional idletime = 30<br> optional acl = 2<br> shell:roles="\"network-operator vdc-operator\""<br> }<br><br> service = junos-exec {<br> bug-fix = "first pair is lost"<br> local-user-name = "remote"<br> allow-commands = "(.*exit)|(show cli auth.*)"<br> deny-commands = ".*"<br> allow-configuration = ""<br> deny-configuration = ""<br> }<br>after authorization "/usr/bin/python /usr/local/sbin/tacplus/do_auth.py -i $address -u $user -d $name -l /tmp/do_auth.log -f /usr/local/sbin/tacplus/do_auth.ini"</font><font size="3" face="serif"><b><br>}</b></font><font size="3" face="serif"><br><br><br>One more thing... Looking at your do_auth.ini, you seem to have a space between the commands and ".*" which should not be there.<br><br>For example:<br><br>exit .*<br><br>...should be:<br><br>exit.*<br> <br><br>I posted a complete working tac_plus.conf and do_auth.ini along with the AAA config I use on devices the other day. Take a look at that post as well.<br><br><br>--<br>John Fraizer<br>LinkedIn profile: </font><a href="http://www.linkedin.com/in/johnfraizer/" target="_blank"><font size="3" color="#0000FF" face="serif"><u>http://www.linkedin.com/in/johnfraizer/</u></font></a><font size="3" face="serif"><br><br><br><br>On Fri, Aug 7, 2015 at 5:16 AM, <</font><a href="mailto:Kevin.Cruse@instinet.com" target="_blank"><font size="3" color="#0000FF" face="serif"><u>Kevin.Cruse@instinet.com</u></font></a><font size="3" face="serif">> wrote:</font><ul style="padding-left:36pt"><font size="2" face="sans-serif">I will try upgrading to 4.14.5F and see what happens! thanks<br><br>wondering if you are familiar with this error in do_auth execution, I am permitting exit in do_auth.ini. seems to be some issue with do_auth script:<br><br>Reading config<br>Version F4.0.4.28 Initialized 1<br>tac_plus server F4.0.4.28 starting<br>socket FD 4 AF 2<br>uid=0 euid=0 gid=0 egid=0 s=23660848<br>connect from router1 [172.28.10.124]<br>Start authorization request<br>do_author: user='testuser'<br>user 'testuser' found<br>authorize_cmd: user=testuser, cmd=exit<br>cmd exit does not exist, denied by default<br>After authorization call: /usr/bin/python /usr/local/sbin/tacplus/do_auth.py -u $user -l /var/log/tacacs/do_auth_log.txt -f /usr/local/sbin/tacplus/do_auth.ini</font><font size="2" face="sans-serif"><b><br>substitute: /usr/bin/python /usr/local/sbin/tacplus/do_auth.py -u $user -l /var/log/tacacs/do_auth_log.txt -f /usr/local/sbin/tacplus/do_auth.ini<br>Dollar substitution: /usr/bin/python /usr/local/sbin/tacplus/do_auth.py -u testuser -l /var/log/tacacs/do_auth_log.txt -f /usr/local/sbin/tacplus/do_auth.ini<br>pid 24672 child exited status 1</b></font><font size="2" face="sans-serif"><br>cmd /usr/bin/python /usr/local/sbin/tacplus/do_auth.py -u $user -l /var/log/tacacs/do_auth_log.txt -f /usr/local/sbin/tacplus/do_auth.ini returns 1 (unconditional deny)<br>authorization query for 'testuser' tty130 from router1 rejected<br>connect from router1 [1.1.1.1]</font><font size="3" face="serif"><br></font><font size="2" face="sans-serif"><br><br>do_auth.ini:<br><br>[users]<br>testuser =<br> snm<br>[snm]<br>command_deny =<br> configure .*<br> show controllers vip .*<br>command_permit =<br> show ip .*<br> show interface .*<br> clear counters .*<br> clear qos stat .*<br> clear mls qos int .*<br> disable .*<br> enable .*<br> end .*<br> exit .*<br> logout .*<br> ping .*<br> set length .*<br> show .*<br> skip-page-display .*<br> write network .*<br> write terminal .*<br> write memory .*</font><font size="3" face="serif"><br><br><br><br><br></font><img src="cid:1__=0ABBF437DFF169458f9e@AMERICAS.CORP.LOCAL" width="16" height="16" alt="Inactive hide details for John Fraizer ---08/06/2015 06:54:05 PM---I'm not sure when this command became available in EOS but, "><font size="2" color="#424282" face="sans-serif">John Fraizer ---08/06/2015 06:54:05 PM---I'm not sure when this command became available in EOS but, at least in 4.14.5F, you will get what y</font><font size="1" color="#5F5F5F" face="sans-serif"><br><br>From: </font><font size="1" face="sans-serif">John Fraizer <</font><a href="mailto:john@op-sec.us" target="_blank"><font size="1" color="#0000FF" face="sans-serif"><u>john@op-sec.us</u></font></a><font size="1" face="sans-serif">></font><font size="1" color="#5F5F5F" face="sans-serif"><br>To: </font><font size="1" face="sans-serif">"Kevin.Cruse@Instinet.com" <</font><a href="mailto:Kevin.Cruse@instinet.com" target="_blank"><font size="1" color="#0000FF" face="sans-serif"><u>Kevin.Cruse@instinet.com</u></font></a><font size="1" face="sans-serif">>, </font><font size="1" color="#5F5F5F" face="sans-serif"><br>Cc: </font><font size="1" face="sans-serif">Daniel Schmidt <</font><a href="mailto:daniel.schmidt@wyo.gov" target="_blank"><font size="1" color="#0000FF" face="sans-serif"><u>daniel.schmidt@wyo.gov</u></font></a><font size="1" face="sans-serif">>, "</font><a href="mailto:tac_plus@shrubbery.net" target="_blank"><font size="1" color="#0000FF" face="sans-serif"><u>tac_plus@shrubbery.net</u></font></a><font size="1" face="sans-serif">" <</font><a href="mailto:tac_plus@shrubbery.net" target="_blank"><font size="1" color="#0000FF" face="sans-serif"><u>tac_plus@shrubbery.net</u></font></a><font size="1" face="sans-serif">></font><font size="1" color="#5F5F5F" face="sans-serif"><br>Date: </font><font size="1" face="sans-serif">08/06/2015 06:54 PM</font><font size="1" color="#5F5F5F" face="sans-serif"><br>Subject: </font><font size="1" face="sans-serif">Re: [tac_plus] Cisco Nexus Authorization problem</font><font size="3" face="serif"><br></font><hr width="100%" size="2" align="left" noshade><font size="3" face="serif"><br><br><br><br>I'm not sure when this command became available in EOS but, at least in 4.14.5F, you will get what you want with:</font><font size="2" color="#500050" face="serif"><br><br>aaa authorization commands all default group tacacs+ none</font><font size="3" face="serif"><br><br><br>--<br>John Fraizer<br>LinkedIn profile: </font><a href="http://www.linkedin.com/in/johnfraizer/" target="_blank"><font size="3" color="#0000FF" face="serif"><u>http://www.linkedin.com/in/johnfraizer/</u></font></a><font size="3" face="serif"><br><br><br><br>On Thu, Aug 6, 2015 at 1:58 PM, <</font><a href="mailto:Kevin.Cruse@instinet.com" target="_blank"><font size="3" color="#0000FF" face="serif"><u>Kevin.Cruse@instinet.com</u></font></a><font size="3" face="serif">> wrote:</font><ul style="padding-left:36pt"><font size="3" face="serif">tried that! arista only takes this command with no arguments:<br><br>aaa authorization config-commands<br><br>it still didn't work.<br><br>fyi - i just tried same config with cisco router and it works perfectly,<br>running 4.13.11M of EOS.<br><br><br><br>From: Daniel Schmidt <</font><a href="mailto:daniel.schmidt@wyo.gov" target="_blank"><font size="3" color="#0000FF" face="serif"><u>daniel.schmidt@wyo.gov</u></font></a><font size="3" face="serif">><br>To: </font><a href="mailto:Kevin.Cruse@instinet.com" target="_blank"><font size="3" color="#0000FF" face="serif"><u>Kevin.Cruse@instinet.com</u></font></a><font size="3" face="serif">,<br>Cc: Aaron Wasserott <</font><a href="mailto:aaron.wasserott@viawest.com" target="_blank"><font size="3" color="#0000FF" face="serif"><u>aaron.wasserott@viawest.com</u></font></a><font size="3" face="serif">>,<br> "</font><a href="mailto:tac_plus@shrubbery.net" target="_blank"><font size="3" color="#0000FF" face="serif"><u>tac_plus@shrubbery.net</u></font></a><font size="3" face="serif">" <</font><a href="mailto:tac_plus@shrubbery.net" target="_blank"><font size="3" color="#0000FF" face="serif"><u>tac_plus@shrubbery.net</u></font></a><font size="3" face="serif">><br>Date: 08/06/2015 04:09 PM<br>Subject: Re: [tac_plus] Cisco Nexus Authorization problem<br><br><br><br>This part of the email looks interesting:<br><br>But if you<br>want them in conf t mode but restrict their commands at that level, you<br>need to enable something like this:<br><br>aaa authorization config-commands default group myTacacsGroup local</font></ul><font size="1" face="Georgia"><i><br><br>========================================================================================================= </i></font><p><font size="1" face="Georgia"><b><i><<<< Disclaimer >>>></i></b></font><font size="1" face="Georgia"><i> </i></font></p><p><font size="1" face="Georgia"><i>This message is intended solely for use by the named addressee(s). If you receive this transmission in error, please immediately notify the sender and destroy this message in its entirety, whether in electronic or hard copy format. Any unauthorized use (and reliance thereon), copying, disclosure, retention, or distribution of this transmission or the material in this transmission is forbidden. We reserve the right to monitor and archive electronic communications. This material does not constitute an offer or solicitation with respect to the purchase or sale of any security. It should not be construed to contain any recommendation regarding any security or strategy. Any views expressed are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. This communication is provided on an “as is” basis. It contains material that is owned by Instinet Incorporated, its subsidiaries or its or their licensors, and may not, in whole or in part, be (i) copied, photocopied or duplicated in any form, by any means, or (ii) redistributed, posted, published, excerpted, or quoted without Instinet Incorporated's prior written consent. Please access the following link for important information and instructions: </i></font><a href="http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt" target="_blank"><font size="1" color="#0000FF" face="Georgia"><i><u>http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt</u></i></font></a><font size="1" face="Georgia"><i> </i></font></p><p><font size="1" face="Georgia"><i>Securities products and services are provided by locally registered brokerage subsidiaries of Instinet Incorporated: Instinet Australia Pty Limited (ACN: 131 253 686 AFSL No: 327834), regulated by the Australian Securities & Investments Commission; Instinet Canada Limited, member IIROC/CIPF; Instinet Pacific Limited, authorized and regulated by the Securities and Futures Commission of Hong Kong; Instinet Singapore Services Private Limited, regulated by the Monetary Authority of Singapore, trading member of The Singapore Exchange Securities Trading Private Limited and clearing member of The Central Depository (Pte) Limited; and Instinet, LLC, member SIPC. </i></font></p><p><font size="1" face="Georgia"><i><br><br>========================================================================================================= </i></font></p><p></p><p></p><p></p></ul><br>
<p><font size="1" face="sans-serif"><i><br><br>========================================================================================================= </i></font></p><p><font size="1" face="Georgia"><b><i><<<< Disclaimer >>>></i></b></font><font size="1" face="Georgia"><i> </i></font></p><p><font size="1" face="Georgia"><i>This message is intended solely for use by the named addressee(s). If you receive this transmission in error, please immediately notify the sender and destroy this message in its entirety, whether in electronic or hard copy format. Any unauthorized use (and reliance thereon), copying, disclosure, retention, or distribution of this transmission or the material in this transmission is forbidden. We reserve the right to monitor and archive electronic communications. This material does not constitute an offer or solicitation with respect to the purchase or sale of any security. It should not be construed to contain any recommendation regarding any security or strategy. Any views expressed are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. This communication is provided on an “as is” basis. It contains material that is owned by Instinet Incorporated, its subsidiaries or its or their licensors, and may not, in whole or in part, be (i) copied, photocopied or duplicated in any form, by any means, or (ii) redistributed, posted, published, excerpted, or quoted without Instinet Incorporated's prior written consent. Please access the following link for important information and instructions: </i></font><a href="http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt" target="_blank"><font size="1" color="#0000FF" face="Georgia"><i><u>http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt</u></i></font></a><font size="1" face="Georgia"><i> </i></font></p><p><font size="1" face="Georgia"><i>Securities products and services are provided by locally registered brokerage subsidiaries of Instinet Incorporated: Instinet Australia Pty Limited (ACN: 131 253 686 AFSL No: 327834), regulated by the Australian Securities & Investments Commission; Instinet Canada Limited, member IIROC/CIPF; Instinet Pacific Limited, authorized and regulated by the Securities and Futures Commission of Hong Kong; Instinet Singapore Services Private Limited, regulated by the Monetary Authority of Singapore, trading member of The Singapore Exchange Securities Trading Private Limited and clearing member of The Central Depository (Pte) Limited; and Instinet, LLC, member SIPC. </i></font></p><p><font size="1" face="Georgia"><i><br><br>========================================================================================================= </i></font></p><p></p><p></p><p></p><p></p><p></p></ul><br>
<p><font face="sans-serif"></font></p><div style="font-size:12px;font-style:italic;font-family:georgia,arial,sans-serif"><font face="sans-serif">
<br><br>
=========================================================================================================
<div style="font-size:12px;font-style:italic;font-family:georgia,arial,sans-serif">
<p>
<b><<<< Disclaimer >>>></b>
</p><p>
This message is intended solely for use by the named addressee(s). If you receive this transmission in error, please immediately notify the sender and destroy this message in its entirety, whether in electronic or hard copy format. Any unauthorized use (and reliance thereon), copying, disclosure, retention, or distribution of this transmission or the material in this transmission is forbidden. We reserve the right to monitor and archive electronic communications. This material does not constitute an offer or solicitation with respect to the purchase or sale of any security. It should not be construed to contain any recommendation regarding any security or strategy. Any views expressed are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. This communication is provided on an “as is” basis. It contains material that is owned by Instinet Incorporated, its subsidiaries or its or their licensors, and may not, in whole or in part, be (i) copied, photocopied or duplicated in any form, by any means, or (ii) redistributed, posted, published, excerpted, or quoted without Instinet Incorporated's prior written consent. Please access the following link for important information and instructions: <a href="http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt" target="_blank"> http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt</a>
</p><p>
Securities products and services are provided by locally registered brokerage subsidiaries of Instinet Incorporated: Instinet Australia Pty Limited (ACN: 131 253 686 AFSL No: 327834), regulated by the Australian Securities & Investments Commission; Instinet Canada Limited, member IIROC/CIPF; Instinet Pacific Limited, authorized and regulated by the Securities and Futures Commission of Hong Kong; Instinet Singapore Services Private Limited, regulated by the Monetary Authority of Singapore, trading member of The Singapore Exchange Securities Trading Private Limited and clearing member of The Central Depository (Pte) Limited; and Instinet, LLC, member SIPC.
</p><p>
<br><br>
=========================================================================================================
</p><p></p><p></p><p></p></div></font></div>
<p></p></div></div><p></p></div>
</blockquote></div><br></div></div>