<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<STYLE type=text/css> P, UL, OL, DL, DIR, MENU, PRE { margin: 0 auto;}</STYLE>
<META name=GENERATOR content="MSHTML 11.00.9600.18163"></HEAD>
<BODY leftMargin=1 rightMargin=1 topMargin=1><FONT size=2 face="Segoe UI">
<DIV>Hello,</DIV>
<DIV> </DIV>
<DIV>I am currently trying to put myself through a crash course with tac_plus to assist a customer. We sell an NTP server which supports TACACS+ for authentication. The server has a web interface (port 80) and and SSH interface (port 22). A relatively default tac_plus installation on a debian server is allowing us to log in to the web interface but the SSH login (with the same user) is getting rejected. According to the manufacturuer the SSH login is not supported with TACACS+ but I'm convinced it should be able to work as I can see the NTP server is sending requests to the TACACS+ server when we attempt to log in.</DIV>
<DIV> </DIV>
<DIV>This is the current tac_plus.conf that works with the web login (user "support" is an existing user on the debian system):</DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="Courier New">accounting file = /var/log/tac_plus.acct<BR>key = testing123<BR></FONT></DIV>
<DIV><FONT size=2 face="Courier New">user = DEFAULT {<BR> login = PAM<BR> service = ppp protocol = ip {}<BR>}<BR></FONT></DIV>
<DIV><FONT size=2 face="Segoe UI"><FONT face="Courier New">group = netadmin {<BR> default service = permit<BR> login = file /etc/passwd<BR> service = exec {}<BR>}<BR><BR>user = support {<BR> member = netadmin<BR>}</FONT><BR></DIV></FONT>
<DIV>If I enable debugging on tac_plus (<FONT size=2 face="Segoe UI"><EM>tac_plus -C /etc/tacacs+/tac_plus.conf -g -d 256</EM></FONT>) this is what I get with a successful web login:</DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="Courier New">Reading config<BR>Version F4.0.4.19 Initialized 1<BR>tac_plus server F4.0.4.19 starting<BR>uid=0 euid=0 gid=0 egid=0 s=4<BR>session request from 172.31.100.88 sock=5<BR>connect from 172.31.100.88 [172.31.100.88]<BR>Waiting for packet<BR>Read AUTHEN/START size=48<BR>validation request from 172.31.100.88<BR>PACKET: key=testing123<BR>version 192 (0xc0), type 1, seq no 1, flags 0x1<BR>session_id 363537244 (0x15ab235c), Data length 36 (0x24)<BR>End header<BR>type=AUTHEN/START, priv_lvl = 0<BR>action=login<BR>authen_type=ascii<BR>service=ppp<BR>user_len=7 port_len=7 (0x7), rem_addr_len=7 (0x7)<BR>data_len=7<BR>User:<BR>support<BR>port:<BR>unknown<BR>rem_addr:<BR>unknown<BR>data:<BR>Supp0rt<BR>End packet<BR>Authen Start request<BR>choose_authen chose default_fn<BR>Calling authentication function<BR>Writing AUTHEN/GETPASS size=28<BR>PACKET: key=testing123<BR>
version 192 (0xc0), type 1, seq no 2, flags 0x1<BR>session_id 363537244 (0x15ab235c), Data length 16 (0x10)<BR>End header<BR>type=AUTHEN status=5 (AUTHEN/GETPASS) flags=0x1<BR>msg_len=10, data_len=0<BR>msg:<BR>Password:<BR>data:<BR>End packet<BR>Waiting for packet<BR>Read AUTHEN/CONT size=24<BR>PACKET: key=testing123<BR>version 192 (0xc0), type 1, seq no 3, flags 0x1<BR>session_id 363537244 (0x15ab235c), Data length 12 (0xc)<BR>End header<BR>type=AUTHEN/CONT<BR>user_msg_len 7 (0x7), user_data_len 0 (0x0)<BR>flags=0x0<BR>User msg:<BR>Supp0rt<BR>User data:<BR>End packet<BR>login query for 'support' unknown from 172.31.100.88 accepted<BR>Writing AUTHEN/SUCCEED size=18<BR>PACKET: key=testing123<BR>version 192 (0xc0), type 1, seq no 4, flags 0x1<BR>session_id 363537244 (0x15ab235c), Data length 6 (0x6)<BR>End header<BR>type=AUTHEN status=1 (AUTHEN/SUCCEED) flags=0x0<BR>
msg_len=0, data_len=0<BR>msg:<BR>data:<BR>End packet<BR>172.31.100.88: disconnect</FONT></DIV>
<DIV> </DIV>
<DIV>And this is what I get with a failed ssh login:</DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="Courier New">Reading config<BR>Version F4.0.4.19 Initialized 1<BR>tac_plus server F4.0.4.19 starting<BR>uid=0 euid=0 gid=0 egid=0 s=4<BR>session request from 172.31.100.88 sock=5<BR>connect from 172.31.100.88 [172.31.100.88]<BR>Waiting for packet<BR>Read AUTHEN/START size=54<BR>validation request from 172.31.100.88<BR>PACKET: key=testing123<BR>version 192 (0xc0), type 1, seq no 1, flags 0x1<BR>session_id 1969877126 (0x7569f086), Data length 42 (0x2a)<BR>End header<BR>type=AUTHEN/START, priv_lvl = 0<BR>action=login<BR>authen_type=ascii<BR>service=ppp<BR>user_len=7 port_len=3 (0x3), rem_addr_len=11 (0xb)<BR>data_len=13<BR>User:<BR>support<BR>port:<BR>ssh<BR>rem_addr:<BR>172.31.2.22<BR>data:<BR>0x8 0xa<BR>End packet<BR>Authen Start request<BR>choose_authen chose default_fn<BR>Calling authentication function<BR>Writing AUTHEN/GETPASS size=28<BR>
PACKET: key=testing123<BR>version 192 (0xc0), type 1, seq no 2, flags 0x1<BR>session_id 1969877126 (0x7569f086), Data length 16 (0x10)<BR>End header<BR>type=AUTHEN status=5 (AUTHEN/GETPASS) flags=0x1<BR>msg_len=10, data_len=0<BR>msg:<BR>Password:<BR>data:<BR>End packet<BR>Waiting for packet<BR>Read AUTHEN/CONT size=30<BR>PACKET: key=testing123<BR>version 192 (0xc0), type 1, seq no 3, flags 0x1<BR>session_id 1969877126 (0x7569f086), Data length 18 (0x12)<BR>End header<BR>type=AUTHEN/CONT<BR>user_msg_len 13 (0xd), user_data_len 0 (0x0)<BR>flags=0x0<BR>User msg:<BR>0x8 0xa<BR>User data:<BR>End packet<BR>login query for 'support' ssh from 172.31.100.88 rejected<BR>login failure: support 172.31.100.88 (172.31.100.88) ssh<BR>Writing AUTHEN/FAIL size=18<BR>PACKET: key=testing123<BR>version 192 (0xc0), type 1, seq no 4, flags 0x1<BR>
session_id 1969877126 (0x7569f086), Data length 6 (0x6)<BR>End header<BR>type=AUTHEN status=2 (AUTHEN/FAIL) flags=0x0<BR>msg_len=0, data_len=0<BR>msg:<BR>data:<BR>End packet<BR>172.31.100.88: disconnect</FONT></DIV>
<DIV><BR>The main difference I can see being the "port: unknown" and "port: ssh". I feel like there should be something I can set in tac_plus.conf to enable this. I've tried this with no joy:</DIV>
<DIV> </DIV>
<DIV><FONT size=2 face="Segoe UI">group = netadmin {<BR> default service = permit<BR> login = file /etc/passwd<BR> service = exec {}<BR> service = ppp protocol = ip {<BR> port = 22<BR> }<BR>}<BR></FONT></DIV>
<DIV>Can anyone offer any suggestions? </DIV>
<DIV> </DIV>
<DIV>Many thanks.</DIV>
<DIV> </DIV>
<DIV>PS. the TACACS+ config on the NTP server itself is very simple. It's just a field for the IP address of the TACACS+ server and one for the shared secret.</DIV>
<DIV> </DIV>
<DIV><BR>Regards,</DIV>
<DIV> </DIV>
<DIV>Darren Share<BR></DIV></FONT><br clear="both">
______________________________________________________________________<BR>
This email has been scanned by the Symantec Email Security.cloud service.<BR>
For more information please visit http://www.symanteccloud.com<BR>
______________________________________________________________________<BR>
</BODY></HTML>