<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Ok, I've taken the do_auth leap to try and secure our rancid logins.</p>
<p><br>
</p>
<p>I've added this line to the end of the rancid group within tac_plus.conf:</p>
<p><br>
</p>
<p>after authorization "/usr/bin/python /root/tacacs-do_auth/do_auth.py -i $address -u $user -d $name -l /root/tacacs-do_auth/log.txt -f /root/tacacs-do_auth/do_auth.ini"<br>
</p>
<p><br>
</p>
<p>And I have a simple/default do_auth.ini file:</p>
<p><br>
</p>
<p>rancid =</p>
<p> fewcommands</p>
<p><br>
</p>
<p>[fewcommands]</p>
<p>host_allow =</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>.*</p>
<p>device_permit =</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>.*</p>
<p>command_permit =</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>show users</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>show int.*</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>show ip int.*</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>show controllers.*</p>
<p><span class="Apple-tab-span" style="white-space:pre"></span>show conf.*</p>
<div><br>
</div>
<p>But I seem to be getting these errors in the do_auth.log. I checked and the file exists and seems permissions are ok:</p>
<p><br>
</p>
<p>root@sjc-nettools01:~/tacacs-do_auth# more log.txt</p>
<p>2015-08-03 15:09:00,229 [CRITICAL]: Can't open/parse config file: '/root/tacacs-do_auth/do_auth.ini'</p>
<p>2015-08-03 15:16:18,673 [CRITICAL]: Can't open/parse config file: '/root/tacacs-do_auth/do_auth.ini'</p>
<p>2015-08-03 15:16:40,629 [CRITICAL]: Can't open/parse config file: '/root/tacacs-do_auth/do_auth.ini'</p>
<p>2015-08-04 14:57:49,990 [CRITICAL]: Can't open/parse config file: '/root/tacacs-do_auth/do_auth.ini'</p>
<p>root@sjc-nettools01:~/tacacs-do_auth# ls -lrt /root/tacacs-do_auth/do_auth.ini</p>
<p>-rw-r--r-- 1 root root 343 Aug 3 15:25 /root/tacacs-do_auth/do_auth.ini</p>
<p>root@sjc-nettools01:~/tacacs-do_auth#</p>
<p><br>
</p>
<p><br>
</p>
<p>tac_plus.log:</p>
<p><br>
</p>
<p>Tue Aug 4 15:10:36 2015 [2950]: After authorization call: /usr/bin/python /root/tacacs-do_auth/do_auth.py -i $address -u $user -d $name -l /root/tacacs-do_auth/log.txt -f /root/tacacs-do_auth/do_auth.ini</p>
<p>Tue Aug 4 15:10:36 2015 [2950]: substitute: /usr/bin/python /root/tacacs-do_auth/do_auth.py -i $address -u $user -d $name -l /root/tacacs-do_auth/log.txt -f /root/tacacs-do_auth/do_auth.ini</p>
<p>Tue Aug 4 15:10:36 2015 [2950]: Dollar substitution: /usr/bin/python /root/tacacs-do_auth/do_auth.py -i 10.1.21.1 -u rancid -d 10.1.0.8 -l /root/tacacs-do_auth/log.txt -f /root/tacacs-do_auth/do_auth.ini</p>
<p>Tue Aug 4 15:10:36 2015 [2950]: input service=junos-exec</p>
<p>Tue Aug 4 15:10:36 2015 [2950]: input local-user-name=remote-rancid</p>
<p>Tue Aug 4 15:10:36 2015 [2950]: pid 2951 child exited status 1</p>
<p>Tue Aug 4 15:10:36 2015 [2950]: cmd /usr/bin/python /root/tacacs-do_auth/do_auth.py -i $address -u $user -d $name -l /root/tacacs-do_auth/log.txt -f /root/tacacs-do_auth/do_auth.ini returns 1 (unconditional deny)</p>
<p>Tue Aug 4 15:10:36 2015 [2950]: authorization query for 'rancid' unknown from 10.1.0.8 rejected</p>
<p>Tue Aug 4 15:10:36 2015 [2953]: connect from 10.1.0.8 [10.1.0.8]</p>
<p><br>
</p>
<p><br>
</p>
<p>I wish it would output more debugs, but that's all I got to go on. </p>
<p><br>
</p>
<p>Anybody see this before? </p>
<p><br>
</p>
<p><br>
</p>
</div>
</body>
</html>