<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Jun 16, 2014 at 3:02 PM, Aaron Wasserott <span dir="ltr"><<a href="mailto:aaron.wasserott@viawest.com" target="_blank">aaron.wasserott@viawest.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">In both do_auth.ini and tac_plus.conf be sure to spell the special username as "DEFAULT" - minding the upper-case.<br>
<br>
Do you have any log entries for that failed attempt in /root/do_auth/do_auth.log?<br></blockquote><div><br></div><div><div>2014-06-16 16:54:30,195 [CRITICAL]: Did you forget "default service = permit" in tac_plus.conf?</div>
</div><div><br></div><div>That was if I did not have "default service = permit" in the doauthaccess group. </div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
Does your group doauthaccess have the same settings as the other regular group, other than the addition of after auth?<br></blockquote><div><br></div><div>Yes</div><div><br></div><div> <br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
What device type did you test against? I would test against Cisco IOS to start with until you get it working.<br>
<br></blockquote><div><br></div><div>Alcatel Lucent. </div><div><br></div><div>OK let me try against cisco</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
You also might want to try toggling off the "-fix_crs_bug" flag and test login against IOS just to be safe. I've not used that flag before personally.<br>
<div><div class="h5"><br></div></div></blockquote><div><br></div><div>OK</div><div><br></div><div>Thanks</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div><div class="h5">
-----Original Message-----<br>
From: tac_plus [mailto:<a href="mailto:tac_plus-bounces@shrubbery.net">tac_plus-bounces@shrubbery.net</a>] On Behalf Of Asif Iqbal<br>
Sent: Sunday, June 15, 2014 5:09 PM<br>
To: <a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a><br>
Subject: [tac_plus] Need help with do_auth config<br>
<br>
Let me know if there is a separate mailing list for do_auth related questions.<br>
<br>
So I am trying to follow the do_auth.ini syntax and need some help.<br>
<br>
I have setup the config file like below and failing to authorize.<br>
<br>
Here is the do_auth.ini file<br>
<br>
[users]<br>
default =<br>
noprivs<br>
foo =<br>
newgroup<br>
<br>
[newgroup]<br>
host_allow =<br>
.*<br>
command_permit =<br>
show configuration.*<br>
device_permit =<br>
.*<br>
<br>
[noprivs]<br>
host_deny =<br>
.*<br>
device_deny =<br>
.*<br>
command_deny =<br>
.*<br>
<br>
Here is the error message<br>
<br>
Username: iqbala<br>
Password:<br>
% Authorization failed.<br>
Connection closed by foreign host.<br>
<br>
<br>
Here is the relevant part in tacacs.conf<br>
<br>
group = doauthaccess {<br>
after authorization "/usr/bin/python /root/do_auth/do_auth.pyc -i $address -fix_crs_bug -u $user -d $name -l /root/do_auth/do_auth.log -f /root/do_auth/do_auth.ini"<br>
}<br>
<br>
user = foo {<br>
login = PAM<br>
member = doauthaccess<br>
}<br>
<br>
If I change the member to another group which is regular group and not using after authorization, user ``foo'' can login fine.<br>
<br>
I must not do doing something right.<br>
<br>
Please advise.<br>
<br>
<br>
<br>
<br>
--<br>
Asif Iqbal<br>
PGP Key: 0xE62693C5 KeyServer: <a href="http://pgp.mit.edu" target="_blank">pgp.mit.edu</a><br>
A: Because it messes up the order in which people normally read text.<br>
Q: Why is top-posting such a bad thing?<br>
</div></div>-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://www.shrubbery.net/pipermail/tac_plus/attachments/20140615/69fb3916/attachment.html" target="_blank">http://www.shrubbery.net/pipermail/tac_plus/attachments/20140615/69fb3916/attachment.html</a>><br>
_______________________________________________<br>
tac_plus mailing list<br>
<a href="mailto:tac_plus@shrubbery.net">tac_plus@shrubbery.net</a><br>
<a href="http://www.shrubbery.net/mailman/listinfo/tac_plus" target="_blank">http://www.shrubbery.net/mailman/listinfo/tac_plus</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Asif Iqbal<br>PGP Key: 0xE62693C5 KeyServer: <a href="http://pgp.mit.edu">pgp.mit.edu</a><br>A: Because it messes up the order in which people normally read text.<br>
Q: Why is top-posting such a bad thing?<br><br>
</div></div>