<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>So it sounds like I can just use the pam_tally2 instead? When I used that I was able to authenticate but, each time a person logged in successfully via tacacs using pam_tally2 it was counting each of my logins as failed and my user was being locked out after a period of time? Any thoughts on what I may have done wrong to have pam_tally2 track the login as failed though it was allowing the user to login in and work?<br><br><div>> Date: Sat, 28 Dec 2013 14:37:56 -0800<br>> From: krux@thcnet.net<br>> To: ttjones2013@hotmail.com<br>> CC: heas@shrubbery.net; tac_plus@shrubbery.net<br>> Subject: Re: [tac_plus] tac_plus and PAM<br>> <br>> > Please excuse my newbie questions. To utilize PAM do I need to use the<br>> > pam_tacplus module? I currently was only using pam_tally2 but after looking<br>> <br>> No, I think that's a module to have PAM use TACACS+ for authentication.<br>> You'll have to create a tac_plus pam config file under /etc/pam.d. A quick<br>> and easy way to do so, is to "cp /etc/pam.d/ssh /etc/pam.d/tac_plus" which<br>> would copy the same method of authentication for SSH as for TACACS. Of course<br>> you can tweak the authentication settings for PAM so it does something<br>> different for tac_plus. For example, our system uses Kerberos for ssh, but<br>> for TACACS authentication, we want it to use RSA for two factor<br>> authentication.<br>> <br>> perl -e 's==UBER?=+y[:-o]}(;->\n{q-yp-y+k}?print:??;-p#)'<br>> <br></div> </div></body>
</html>