I don't know why that's not working. I would try to increase the debug logging and then try to authorize the commands again and see if there are any log messages that help explain why authorization is being denied. Passing the command-line argument "-d 4088" should enable lots of debugging log messages.<br>
<br>Nathan<br><br><div><span class="gmail_quote">On 2/2/09, <b class="gmail_sendername">Alexander Czutka</b> <<a href="mailto:aczutka@brocade.com">aczutka@brocade.com</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div link="blue" vlink="blue" lang="DE">
<div>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Hello Nathan,</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">Sorry for the delay.</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">I have tried this:</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="FR"># tacacs configuration
file</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="FR"># Pierre-Yves Maunier -
20060713</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"># /etc/tac_plus.conf</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"># set the key</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">key = foundry</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">accounting file =
/var/log/tac_plus.acct</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"># Group definition</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">group = group2 {</span></font></p><span class="q">
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> default
service = deny</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> cmd = show {</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">
permit "ip <cr>"</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> deny
.*</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> } </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
</span><p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"># users accounts</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">user = test {</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> default service =
permit</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> login = cleartext
"test"</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> enable =
cleartext "test"</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> name =
"test"</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">}</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">user = user2 {</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> member =
group2</span></font></p><span class="q">
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> login =
cleartext "user2"</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> enable =
cleartext "user2"</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> }</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
</span><p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"># END</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">Now Iīm not able to
execute any command:</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">telnet@BigIron Router#</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">telnet@BigIron
Router#show ip</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">Not authorized to execute
this command.</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="FR">telnet@BigIron Router#</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="FR">telnet@BigIron Router#</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">telnet@BigIron
Router#show ip route</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">Not authorized to execute
this command.</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="FR">telnet@BigIron Router#</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="FR">telnet@BigIron Router#</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">telnet@BigIron Router#</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">Regards,</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">Alexander</span></font></p>
<div>
<div style="text-align: center;" align="center"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">
<hr align="center" size="2" width="100%">
</span></font></div>
<p><b><font face="Tahoma" size="2"><span style="font-size: 10pt; font-family: Tahoma; font-weight: bold;">Von:</span></font></b><font face="Tahoma" size="2"><span style="font-size: 10pt; font-family: Tahoma;"> <a href="mailto:nschrenk@gmail.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">nschrenk@gmail.com</a>
[mailto:<a href="mailto:nschrenk@gmail.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">nschrenk@gmail.com</a>] <b><span style="font-weight: bold;">Im Auftrag von </span></b>Nathan
Schrenk<br>
<b><span style="font-weight: bold;">Gesendet:</span></b> Freitag, 30. Januar 2009
22:57<div><span class="e" id="q_11f3b05644ed30d6_5"><br>
<b><span style="font-weight: bold;">An:</span></b> Alexander Czutka<br>
<b><span style="font-weight: bold;">Cc:</span></b> <a href="mailto:tac_plus@shrubbery.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">tac_plus@shrubbery.net</a><br>
<b><span style="font-weight: bold;">Betreff:</span></b> Re: [tac_plus] How can I
deny/permit ?</span></div></span></font></p>
</div><div><span class="e" id="q_11f3b05644ed30d6_7">
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;">On 1/30/09, <b><span style="font-weight: bold;">Alexander Czutka</span></b>
<<a href="mailto:aczutka@brocade.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">aczutka@brocade.com</a>> wrote:</span></font></p>
<div>
<blockquote style="border-style: none none none solid; border-color: -moz-use-text-color -moz-use-text-color -moz-use-text-color rgb(204, 204, 204); border-width: medium medium medium 1pt; padding: 0cm 0cm 0cm 6pt; margin-left: 4.8pt; margin-right: 0cm;">
<div link="blue" vlink="blue">
<div>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Hello Nathan,</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">it doesnīt work.</span></font></p>
</div>
</div>
</blockquote>
<div>
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;"><br>
What doesn't work? tac_plus doesn't print the same error message while
parsing the config file as it does without the quotes, does it?<br>
<br>
I normally use a group and deny everything that is not explicitly allowed (a
command blacklist):<br>
<br>
group = mygroup {<br>
default service = deny<br>
cmd = show {<br>
permit "ip <cr>"<br>
deny .*<br>
}<br>
}<br>
user = myuser {<br>
member = mygroup<br>
login = cleartext "mypassword"<br>
}<br>
<br>
Nathan</span></font></p>
</div>
<blockquote style="border-style: none none none solid; border-color: -moz-use-text-color -moz-use-text-color -moz-use-text-color rgb(204, 204, 204); border-width: medium medium medium 1pt; padding: 0cm 0cm 0cm 6pt; margin-left: 4.8pt; margin-right: 0cm;">
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
<div link="blue" vlink="blue">
<div>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">user = user2 {</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">#
member = group2</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">#
debug = REGEX</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">
login = cleartext "user2"</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">
enable = cleartext "user2"</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">
cmd = show {</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">
permit ip</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">
deny "ip ospf"</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;" lang="EN-GB">
</span></font><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">}</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"># END</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Regards,</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;">Alexander</span></font></p>
<p><font color="navy" face="Arial" size="2"><span style="font-size: 10pt; font-family: Arial; color: navy;"> </span></font></p>
<div>
<div style="text-align: center;" align="center"><font face="Times New Roman" size="3"><span style="font-size: 12pt;">
<hr align="center" size="2" width="100%">
</span></font></div>
<p><b><font face="Tahoma" size="2"><span style="font-size: 10pt; font-family: Tahoma; font-weight: bold;">Von:</span></font></b><font face="Tahoma" size="2"><span style="font-size: 10pt; font-family: Tahoma;"> <a href="mailto:nschrenk@gmail.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">nschrenk@gmail.com</a> [mailto:<a href="mailto:nschrenk@gmail.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">nschrenk@gmail.com</a>] <b><span style="font-weight: bold;">Im Auftrag von </span></b>Nathan Schrenk<br>
<b><span style="font-weight: bold;">Gesendet:</span></b> Freitag, 30. Januar 2009
21:14<br>
<b><span style="font-weight: bold;">An:</span></b> Alexander Czutka<br>
<b><span style="font-weight: bold;">Cc:</span></b> <a href="mailto:tac_plus@shrubbery.net" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">tac_plus@shrubbery.net</a><br>
<b><span style="font-weight: bold;">Betreff:</span></b> Re: [tac_plus] How can I
deny/permit ?</span></font></p>
</div>
<div><span>
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;">On
1/30/09, <b><span style="font-weight: bold;">Alexander Czutka</span></b> <<a href="mailto:aczutka@brocade.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">aczutka@brocade.com</a>>
wrote:</span></font></p>
<div>
<blockquote style="border-style: none none none solid; border-color: -moz-use-text-color -moz-use-text-color -moz-use-text-color rgb(204, 204, 204); border-width: medium medium medium 1pt; margin: 5pt 0cm 5pt 4.8pt; padding: 0cm 0cm 0cm 6pt;">
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;">Hello,<br>
<br>
Iīm trying to setup an authorization for a user.<br>
<br>
The user should be allowed to do a:<br>
<br>
- Show ip<br>
- show ip route<br>
<br>
But he shouldnīt execute the commands, which starts with:<br>
<br>
- Show ip ospf<br>
- Show ip pim<br>
<br>
I tried this, but it didnīt work:<br>
<br>
cmd = show {<br>
permit
ip<br>
deny ip
ospf<br>
}<br>
<br>
root@ubuntu-fdry:/# tac_plus -C /etc/tac_plus.conf<br>
Error: expecting '}' but found 'ospf' on line 40<br>
root@ubuntu-fdry:/#<br>
<br>
Is this possible ?</span></font></p>
</blockquote>
<div>
<p style="margin-bottom: 12pt;"><font face="Times New Roman" size="3"><span style="font-size: 12pt;"><br>
Try putting quotes around the tokens:<br>
<br>
cmd = show {<br>
permit
ip<br>
deny
"ip ospf" <br>
}</span></font></p>
</div>
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;">Nathan</span></font></p>
</div>
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
</span></div>
</div>
</div>
</blockquote>
</div>
<p><font face="Times New Roman" size="3"><span style="font-size: 12pt;"> </span></font></p>
</span></div></div>
</div>
</blockquote></div><br>