If the syslog patch was implemented exactly as Mark's original patch, the syntax in your tac_plus.conf is like so:<div><br></div><div><div>accounting syslog</div><div>logging = local6</div><div><br></div><div>Additionally, his login authentication lockout code is available on GitHub:</div>
<div><br></div><div><a href="https://github.com/ellzey/tac_plus_AFL">https://github.com/ellzey/tac_plus_AFL</a></div><div><br></div><div>He provided a patch against 4.0.4.19, which makes it as current as it gets.</div><div>
<br></div><div>Full disclosure: I used to work and am still friends with Mark. ;)</div><div><br></div><div>jathan.</div><br><div class="gmail_quote">On Thu, May 5, 2011 at 2:14 PM, Daniel Schmidt <span dir="ltr"><<a href="mailto:daniel.schmidt@wyo.gov">daniel.schmidt@wyo.gov</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">I thought about that too, but the after authentication script never gets<br>
called on a failed login though.<br>
<br>
Actually, Mark was once working on a feature to lock accounts on failed<br>
logins. I would have rather it locked on IP rather than user, but I once<br>
used it and it seemed to work quite well.<br>
<br>
<a href="http://www.shrubbery.net/pipermail/tac_plus/2009-September/000508.html" target="_blank">http://www.shrubbery.net/pipermail/tac_plus/2009-September/000508.html</a><br>
<br>
-----Original Message-----<br>
From: <a href="mailto:tac_plus-bounces@shrubbery.net">tac_plus-bounces@shrubbery.net</a><br>
[mailto:<a href="mailto:tac_plus-bounces@shrubbery.net">tac_plus-bounces@shrubbery.net</a>] On Behalf Of Alan McKinnon<br>
Sent: Thursday, May 05, 2011 2:36 PM<br>
To: <a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a><br>
Subject: Re: [tac_plus] Mailing list and Syslog question<br>
<div><div></div><div class="h5"><br>
Apparently, though unproven, at 19:29 on Thursday 05 May 2011, Paul Root<br>
did<br>
opine thusly:<br>
<br>
> Is there a mailling list to join for this?<br>
<br>
Yes, it's the address you used. That I replied is proof it works ;-)<br>
<br>
> Also, we are trying to get accounting to go to syslog. But it persists<br>
in<br>
> sending to the file.<br>
><br>
> How is syslog enabled for accounting?<br>
<br>
I also tried to get this to work, and failed. The CHANGES file contains<br>
this:<br>
<br>
F4.0.4.16<br>
- Add 'accounting syslog;' configuration knob - mostly from Mark<br>
Ellzey Thomas<br>
<br>
So there is some level of support. I could not find out how to set the<br>
facility and priority, so I just let tac_plus write to the file (I wanted<br>
a<br>
local copy anyway) and configured syslog-ng to read it and send the logs<br>
onto<br>
my syslogger:<br>
<br>
# Tacacs accounting logs<br>
source s_tac_plus_acc {<br>
file("/var/log/tacacs/accounting",<br>
default-facility(local6),<br>
default-priority(info));<br>
};<br>
# Remote logging to syslogger<br>
destination syslogger {<br>
tcp("xxx.xxx.xxx.xxx" port(514));<br>
};<br>
log { source(s_tac_plus_acc); destination(syslogger); };<br>
<br>
Not the most elegant solution, it does require you to keep your wits about<br>
you<br>
if you change log filenames, but it does work. It's for syslog-ng, AFAIR<br>
syslogd can be brutally assaulted into doing much the same,<br>
<br>
> Lastly, is there a way to disable an account after X number of failed<br>
> attempts?<br>
<br>
Not inside the conf file to the best of my knowledge. You'll have to write<br>
an<br>
external auth script that stores expiry and failed attempts info to do<br>
this.<br>
Check the section "USING PROGRAMS TO DO AUTHORIZATION" in the manual<br>
bundled<br>
with the sources.<br>
<br>
Daniel Schmidt posted links to this very topic just yesterday so I'll<br>
assume<br>
you've only just registered and missed it (unlucky you!). Here's the<br>
relevant<br>
text reposted:<br>
<br>
<a href="http://tacacs.org/" target="_blank">http://tacacs.org/</a><br>
<br>
and this:<br>
python do_auth.py | less<br>
<br>
or maybe this:<br>
<a href="http://www.shrubbery.net/pipermail/tac_plus/2011-March/000879.html" target="_blank">http://www.shrubbery.net/pipermail/tac_plus/2011-March/000879.html</a><br>
<br>
or this:<br>
<a href="http://manpages.ubuntu.com/manpages/maverick/man8/do_auth.8.html" target="_blank">http://manpages.ubuntu.com/manpages/maverick/man8/do_auth.8.html</a><br>
<br>
--<br>
alan dot mckinnon at gmail dot com<br>
_______________________________________________<br>
tac_plus mailing list<br>
<a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a><br>
<a href="http://www.shrubbery.net/mailman/listinfo.cgi/tac_plus" target="_blank">http://www.shrubbery.net/mailman/listinfo.cgi/tac_plus</a><br>
_______________________________________________<br>
tac_plus mailing list<br>
<a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a><br>
<a href="http://www.shrubbery.net/mailman/listinfo.cgi/tac_plus" target="_blank">http://www.shrubbery.net/mailman/listinfo.cgi/tac_plus</a><br>
</div></div></blockquote></div><br><br clear="all"><br>-- <br>Jathan.<br>--<br>
</div>