<div dir="ltr">I'd change your host_allow to .* for the purposes of testing to see if that is it. <br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Mar 16, 2016 at 10:15 AM, heasley <span dir="ltr"><<a href="mailto:heas@shrubbery.net" target="_blank">heas@shrubbery.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Wed, Mar 16, 2016 at 11:52:49AM -0400, Kevin.Cruse@Instinet.com:<br>
<span class="">><br>
> Hi All<br>
><br>
> I have a few questions regarding host keys and do_auth.<br>
><br>
> First, I have a few routers i'd like to configure with a separate<br>
> 'tacac-server key' than rest of our network. These devices require<br>
> external users to access and therefore will need higher level of security.<br>
> In my tac_plus.cfg i have the global configuration of:<br>
><br>
> key = blahblahblah<br>
><br>
> and the individual routers which require different key, i've configured the<br>
> following in tac_plus.cfg:<br>
><br>
> host = 1.1.1.1 {<br>
> key = differentkey<br>
> }<br>
><br>
> The issue I have is when logging into router with separate key, it fails<br>
> authentication as server is expecting 'blahblahblah' but router is sending<br>
> 'differentkey'. I thought by configuring the 'host' object it would<br>
> override the global key. Does anyone know how I may get this to work? I've<br>
> pasted the debug from server for your review<br>
><br>
> tac_plus.cfg<br>
><br>
> key = blahblahblah<br>
><br>
> host = 1.1.1.1 {<br>
> key = differentkey<br>
> }<br>
<br>
</span>yes, this should work. You have obfuscated the addresses below, so is the<br>
device connecting from 1.1.1.1 or another interface? It must match and<br>
can usually be forced by configuring the source-interface on the device.<br>
also, you may need this patch:<br>
<br>
Index: packet.c<br>
===================================================================<br>
--- packet.c (revision 3704)<br>
+++ packet.c (revision 3714)<br>
@@ -147,7 +147,7 @@<br>
/* decrypt the data portion */<br>
tkey = cfg_get_host_key(session.peerip);<br>
if (tkey == NULL && !STREQ(session.peer, session.peerip)) {<br>
- tkey = cfg_get_host_prompt(session.peer);<br>
+ tkey = cfg_get_host_key(session.peer);<br>
}<br>
if (tkey == NULL)<br>
tkey = session.key;<br>
@@ -547,7 +547,7 @@<br>
/* encrypt the data portion */<br>
tkey = cfg_get_host_key(session.peerip);<br>
if (tkey == NULL && !STREQ(session.peer, session.peerip)) {<br>
- tkey = cfg_get_host_prompt(session.peer);<br>
+ tkey = cfg_get_host_key(session.peer);<br>
}<br>
if (tkey == NULL)<br>
tkey = session.key;<br>
Index: CHANGES<br>
===================================================================<br>
--- CHANGES (revision 3704)<br>
+++ CHANGES (revision 3714)<br>
@@ -488,3 +488,4 @@<br>
XXX needs a configure test to check for sha512 support.<br>
- fix libtacacs link - from Gentoo via Ruben Farrelly<br>
- fix -U decription in manpage<br>
+ - call correct function for host key look-up by hostname - Adam Dyess<br>
<div><div class="h5"><br>
><br>
> Debug output:<br>
><br>
> !! ROUTER 1.1.1.1 is configured with "tacacs-server key differentkey" !!<br>
> Reading config<br>
> Version F4.0.4.28 Initialized 1<br>
> tac_plus server F4.0.4.28 starting<br>
> socket FD 4 AF 2<br>
> uid=0 euid=0 gid=0 egid=0 s=15505120<br>
> session request from 1.1.1.1 sock=5<br>
> connect from 1.1.1.1 [172.28.10.124]<br>
> Waiting for packet<br>
> Read AUTHEN/START size=40<br>
> validation request from 1.1.1.1<br>
> PACKET: key=blahblahblah<br>
> version 192 (0xc0), type 1, seq no 1, flags 0x1<br>
> session_id 2825152057 (0xa8646639), Data length 28 (0x1c)<br>
> End header<br>
> type=AUTHEN/START, priv_lvl = 72<br>
> action=UNKNOWN 132<br>
> authen_type=unknown 215<br>
> service=unknown 219<br>
> user_len=208 port_len=45 (0x2d), rem_addr_len=0 (0x0)<br>
> data_len=61<br>
> AUTHEN/START data length (314) exceeds packet length length 20<br>
> 1.1.1.1 : Invalid AUTHEN/START packet (check keys)<br>
> Writing AUTHEN/ERROR size=87<br>
> PACKET: key=blahblahblah<br>
> version 192 (0xc0), type 1, seq no 2, flags 0x1<br>
> session_id 2825152057 (0xa8646639), Data length 75 (0x4b)<br>
> End header<br>
> type=AUTHEN status=7 (AUTHEN/ERROR) flags=0x0<br>
> msg_len=69, data_len=0<br>
> msg:<br>
> 1.1.1.1 : Invalid AUTHEN/START packet (check keys)<br>
> data:<br>
> End packet<br>
> <a href="http://1.1.1.1" rel="noreferrer" target="_blank">1.1.1.1</a>: disconnect<br>
><br>
><br>
> Second, I have the following configured in do_auth.ini (this is a separate<br>
> issue from tacacs-server key and not related...when I normalize the key on<br>
> router to blahblahblah I get the following after successful<br>
> authentication):<br>
><br>
> [users]<br>
> test_support =<br>
> support<br>
> [support]<br>
> host_allow =<br>
> 10.10.10.1<br>
> device_permit =<br>
> 1.1.1.1<br>
> command_permit =<br>
> .*<br>
><br>
> 2016-03-16 11:36:56: User 'test_support' not allowed access to device<br>
> '1.1.1.1' in 'support'->'device_permit'<br>
><br>
> I thought by adding the router IP address of 1.1.1.1 under device_permit it<br>
> should allow user to send commands. I am wondering if im hitting bug?<br>
<br>
</div></div>i believe this just allows the user to login from the host 1.1.1.1.<br>
<div class="HOEnZb"><div class="h5"><br>
_______________________________________________<br>
tac_plus mailing list<br>
<a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a><br>
<a href="http://www.shrubbery.net/mailman/listinfo/tac_plus" rel="noreferrer" target="_blank">http://www.shrubbery.net/mailman/listinfo/tac_plus</a><br>
</div></div></blockquote></div><br></div>
<br>
<br>E-Mail to and from me, in connection with the transaction <br>of public business, is subject to the Wyoming Public Records <br>Act and may be disclosed to third parties.<br>