<html><body><p><font size="2" face="sans-serif">Hi All</font><br><br><font size="2" face="sans-serif">I have a few questions regarding host keys and do_auth.</font><br><br><font size="2" face="sans-serif">First, I have a few routers i'd like to configure with a separate 'tacac-server key' than rest of our network. These devices require external users to access and therefore will need higher level of security. In my tac_plus.cfg i have the global configuration of:</font><br><br><font size="2" face="sans-serif">key = blahblahblah</font><br><br><font size="2" face="sans-serif">and the individual routers which require different key, i've configured the following in tac_plus.cfg:</font><br><br><font size="2" face="sans-serif">host = 1.1.1.1 {</font><br><font size="2" face="sans-serif"> key = differentkey</font><br><font size="2" face="sans-serif"> }</font><br><br><font size="2" face="sans-serif">The issue I have is when logging into router with separate key, it fails authentication as server is expecting 'blahblahblah' but router is sending 'differentkey'. I thought by configuring the 'host' object it would override the global key. Does anyone know how I may get this to work? I've pasted the debug from server for your review</font><br><br><font size="2" face="sans-serif">tac_plus.cfg</font><br><br><font size="2" face="sans-serif">key = blahblahblah</font><br><br><font size="2" face="sans-serif">host = 1.1.1.1 {</font><br><font size="2" face="sans-serif"> key = differentkey</font><br><font size="2" face="sans-serif"> }</font><br><br><br><font size="2" face="sans-serif">Debug output:</font><br><br><font size="2" face="sans-serif">!! ROUTER 1.1.1.1 is configured with "tacacs-server key differentkey" !!</font><br><font size="2" face="sans-serif">Reading config</font><br><font size="2" face="sans-serif">Version F4.0.4.28 Initialized 1</font><br><font size="2" face="sans-serif">tac_plus server F4.0.4.28 starting</font><br><font size="2" face="sans-serif">socket FD 4 AF 2</font><br><font size="2" face="sans-serif">uid=0 euid=0 gid=0 egid=0 s=15505120</font><br><font size="2" face="sans-serif">session request from 1.1.1.1 sock=5</font><br><font size="2" face="sans-serif">connect from 1.1.1.1 [172.28.10.124]</font><br><font size="2" face="sans-serif">Waiting for packet</font><br><font size="2" face="sans-serif">Read AUTHEN/START size=40</font><br><font size="2" face="sans-serif">validation request from 1.1.1.1</font><br><font size="2" face="sans-serif">PACKET: key=blahblahblah</font><br><font size="2" face="sans-serif">version 192 (0xc0), type 1, seq no 1, flags 0x1</font><br><font size="2" face="sans-serif">session_id 2825152057 (0xa8646639), Data length 28 (0x1c)</font><br><font size="2" face="sans-serif">End header</font><br><font size="2" face="sans-serif">type=AUTHEN/START, priv_lvl = 72</font><br><font size="2" face="sans-serif">action=UNKNOWN 132</font><br><font size="2" face="sans-serif">authen_type=unknown 215</font><br><font size="2" face="sans-serif">service=unknown 219</font><br><font size="2" face="sans-serif">user_len=208 port_len=45 (0x2d), rem_addr_len=0 (0x0)</font><br><font size="2" face="sans-serif">data_len=61</font><br><font size="2" face="sans-serif">AUTHEN/START data length (314) exceeds packet length length 20</font><br><font size="2" face="sans-serif">1.1.1.1 : Invalid AUTHEN/START packet (check keys)</font><br><font size="2" face="sans-serif">Writing AUTHEN/ERROR size=87</font><br><font size="2" face="sans-serif">PACKET: key=blahblahblah</font><br><font size="2" face="sans-serif">version 192 (0xc0), type 1, seq no 2, flags 0x1</font><br><font size="2" face="sans-serif">session_id 2825152057 (0xa8646639), Data length 75 (0x4b)</font><br><font size="2" face="sans-serif">End header</font><br><font size="2" face="sans-serif">type=AUTHEN status=7 (AUTHEN/ERROR) flags=0x0</font><br><font size="2" face="sans-serif">msg_len=69, data_len=0</font><br><font size="2" face="sans-serif">msg:</font><br><font size="2" face="sans-serif">1.1.1.1 : Invalid AUTHEN/START packet (check keys)</font><br><font size="2" face="sans-serif">data:</font><br><font size="2" face="sans-serif">End packet</font><br><font size="2" face="sans-serif">1.1.1.1: disconnect</font><br><br><br><font size="2" face="sans-serif">Second, I have the following configured in do_auth.ini (this is a separate issue from tacacs-server key and not related...when I normalize the key on router to blahblahblah I get the following after successful authentication):</font><br><br><font size="2" face="sans-serif">[users]</font><br><font size="2" face="sans-serif">test_support =</font><br><font size="2" face="sans-serif"> support</font><br><font size="2" face="sans-serif">[support]</font><br><font size="2" face="sans-serif">host_allow =</font><br><font size="2" face="sans-serif"> 10.10.10.1</font><br><font size="2" face="sans-serif">device_permit =</font><br><font size="2" face="sans-serif"> 1.1.1.1</font><br><font size="2" face="sans-serif">command_permit =</font><br><font size="2" face="sans-serif"> .*</font><br><br><font size="2" face="sans-serif">2016-03-16 11:36:56: User 'test_support' not allowed access to device '1.1.1.1' in 'support'->'device_permit'</font><br><br><font size="2" face="sans-serif">I thought by adding the router IP address of 1.1.1.1 under device_permit it should allow user to send commands. I am wondering if im hitting bug?</font><br><br><br><font size="2" face="sans-serif">Any ideas, thoughts, suggestions greatly appreciated. Thanks.</font><br><font size="2" face="sans-serif"><br>Kevin</font><br><br><br>
<p><font size="2" color="#707070" face="MS Sans Serif">-----------------------------------------------------------------</font><br><font size="1" color="#707070" face="Arial"><b>Kevin Cruse</b></font><font size="1" color="#707070" face="Arial"><br>US Networks<br>Instinet LLC<br>309 West 49th Street<br>New York, NY 10019 US<br>kevin.cruse@instinet.com<br>212-310-4734</font><br><img src="cid:1__=0ABBF5EBDFC65A638f9e@AMERICAS.CORP.LOCAL" width="155" height="45"><font face="sans-serif"><div style="font-size:12px; font-style:italic; font-family:georgia,arial,sans-serif">
<br><br>
=========================================================================================================
<div style="font-size:12px; font-style:italic; font-family:georgia,arial,sans-serif">
<p>
<B><<<< Disclaimer >>>></B>
<p>
This message is intended solely for use by the named addressee(s). If you receive this transmission in error, please immediately notify the sender and destroy this message in its entirety, whether in electronic or hard copy format. Any unauthorized use (and reliance thereon), copying, disclosure, retention, or distribution of this transmission or the material in this transmission is forbidden. We reserve the right to monitor and archive electronic communications. This material does not constitute an offer or solicitation with respect to the purchase or sale of any security. It should not be construed to contain any recommendation regarding any security or strategy. Any views expressed are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. This communication is provided on an “as is” basis. It contains material that is owned by Instinet Incorporated, its subsidiaries or its or their licensors, and may not, in whole or in part, be (i) copied, photocopied or duplicated in any form, by any means, or (ii) redistributed, posted, published, excerpted, or quoted without Instinet Incorporated's prior written consent. Please access the following link for important information and instructions: <a href=" http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt"> http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt</a>
<p>
Securities products and services are provided by locally registered brokerage subsidiaries of Instinet Incorporated: Instinet Australia Pty Limited (ACN: 131 253 686 AFSL No: 327834), regulated by the Australian Securities & Investments Commission; Instinet Canada Limited, member IIROC/CIPF; Instinet Pacific Limited, authorized and regulated by the Securities and Futures Commission of Hong Kong; Instinet Singapore Services Private Limited, regulated by the Monetary Authority of Singapore, trading member of The Singapore Exchange Securities Trading Private Limited and clearing member of The Central Depository (Pte) Limited; and Instinet, LLC, member SIPC.
<p>
<br><br>
=========================================================================================================
</div></font>
</body></html>