<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>At the time I did it, many years ago, it was easier to type those lines than setup tacacs. For the sake of anyone else looking for a solution who also does not have tacacs, that's mine; hard or otherwise, the reader can determine for themselves!</div><div><br></div><div>Jethro.</div><div><br>On 27 Jan 2014, at 15:59, Daniel Schmidt <<a href="mailto:daniel.schmidt@wyo.gov">daniel.schmidt@wyo.gov</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr">You're making it hard. I'd recommenced you you look into tacacs authorization. </div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jan 27, 2014 at 7:12 AM, Jethro R Binks <span dir="ltr"><<a href="mailto:jethro.binks@strath.ac.uk" target="_blank">jethro.binks@strath.ac.uk</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On Fri, 24 Jan 2014, Gordon Ross wrote:<br>
<br>
> I didn't want to give the Level 15 enable password for my ASAs to<br>
> Rancid, so I've tried to configure Rancid to use a customer privilege<br>
> level, but I'm stuck at the last hurdle and Rancid doesn't seem able to<br>
> get the config.<br>
<br>
</div>I can't remember if this is all of what is required, but I have an ASA<br>
that looks like this:<br>
<br>
username rancid password PASSWORD encrypted privilege 7<br>
privilege cmd level 7 mode exec command more<br>
privilege cmd level 7 mode exec command dir<br>
privilege cmd level 7 mode exec command write<br>
privilege cmd level 7 mode exec command terminal<br>
privilege show level 7 mode exec command running-config<br>
privilege show level 7 mode exec command version<br>
privilege show level 7 mode exec command bootvar<br>
privilege show level 7 mode exec command names<br>
privilege show level 7 mode exec command vlan<br>
privilege show level 7 mode exec command module<br>
<br>
I'm running an old version of clogin specified as "cisco" in router.db,<br>
but I also have a note that I modified it to send "terminal pager 0" as<br>
well as "terminal length 0".<br>
<br>
To find out where yours is going wrong though, you'll need to run rancid<br>
in debug mode, along the lines of:<br>
<br>
env NOPIPE=YES PATH=${PATH}:/usr/local/libexec/rancid rancid -d devicename<br>
<br>
and inspect the *.raw file to see where it went wrong.<br>
<br>
Jethro.<br>
<div><div class="h5"><br>
<br>
<br>
> The steps I took were:<br>
><br>
> * Copied bin/clogin to asa-clogin.<br>
><br>
> * Changed the 'send "enable\r"' command to be 'send "enable 4\r"' in asa-clogin<br>
><br>
> * In rancid-fe, I added an entry of "'asa' => 'asa-clogin',"<br>
><br>
> * In my router.db I added "asa1.example.com:asa:up"<br>
><br>
> * Added the asa's credentials to .clogin<br>
><br>
> If I run (as the rancid user) "asa-clogin <a href="http://asa1.example.com" target="_blank">asa1.example.com</a>" I end up at<br>
> an enable prompt on my asa:<br>
><br>
> asa-1/act#<br>
><br>
> But when rancid runs, the logs show:<br>
><br>
> Trying to get all of the configs.<br>
> <a href="http://asa-1.example.com" target="_blank">asa-1.example.com</a><br>
> spawn ssh -c 3des -x -l rancid <a href="http://asa-1.example.com" target="_blank">asa-1.example.com</a><br>
> <a href="mailto:rancid@asa-1.example.com">rancid@asa-1.example.com</a>'s password:<br>
> Type help or '?' for a list of available commands.<br>
> asa-1/act> enable 4<br>
> Password: ***********<br>
> asa-1/act#<br>
> asa-1/act# =====================================<br>
> Getting missed routers: round 1.<br>
> ....<br>
><br>
> The rancid ASA can do show ver, show run, etc.<br>
><br>
> How can I find out what's wrong?<br>
><br>
> Thanks,<br>
><br>
> GTG<br>
> _______________________________________________<br>
> Rancid-discuss mailing list<br>
> <a href="mailto:Rancid-discuss@shrubbery.net">Rancid-discuss@shrubbery.net</a><br>
> <a href="http://www.shrubbery.net/mailman/listinfo/rancid-discuss" target="_blank">http://www.shrubbery.net/mailman/listinfo/rancid-discuss</a><br>
><br>
<br>
</div></div>. . . . . . . . . . . . . . . . . . . . . . . . .<br>
Jethro R Binks, Network Manager,<br>
Information Services Directorate, University Of Strathclyde, Glasgow, UK<br>
<br>
The University of Strathclyde is a charitable body, registered in<br>
Scotland, number SC015263.<br>
<div class="HOEnZb"><div class="h5">_______________________________________________<br>
Rancid-discuss mailing list<br>
<a href="mailto:Rancid-discuss@shrubbery.net">Rancid-discuss@shrubbery.net</a><br>
<a href="http://www.shrubbery.net/mailman/listinfo/rancid-discuss" target="_blank">http://www.shrubbery.net/mailman/listinfo/rancid-discuss</a><br>
</div></div></blockquote></div><br></div>
<pre>E-Mail to and from me, in connection with the transaction
of public business, is subject to the Wyoming Public Records
Act and may be disclosed to third parties.
</pre></div></blockquote></body></html>