<div dir="ltr">If you provide the logs from do_auth and tac_plus, it will help us help you. ;-) Your config for do_auth is broken though. You have to use default service = permit with do_auth.py.<div><br></div><div><br></div><div>This is going to be a LONG email but, it contains working example AAA configs for CatOS, IOS, IOS-XR, NX-OX, Arista EOS and Juniper JUNOS. These are the actual configs I'm using on our network. In addition, I've included working examples for tac_plus.conf and do_auth.ini that will work with these AAA configs.</div><div><br></div><div>Here is the config I use for Arista EOS:</div><div><br></div><div><div>tacacs-server key 7 <redacted></div><div>tacacs-server host x.x.x.A</div><div>tacacs-server host x.x.x.B</div><div><div>!</div><div>aaa authentication login default group tacacs+ local</div><div>aaa authentication enable default group tacacs+ local</div><div>aaa authorization exec default group tacacs+ local</div><div>aaa authorization commands all default group tacacs+ none</div><div>aaa accounting exec default start-stop group tacacs+</div><div>aaa accounting system default start-stop group tacacs+</div><div>aaa accounting commands all default stop-only group tacacs+</div><div>!</div></div></div><div><br></div><div><br></div><div>For CatOS:<br></div><div><br></div><div><div>#tacacs+</div><div>set tacacs server x.x.x.B</div><div>set tacacs server x.x.x.A primary</div><div>set tacacs directedrequest enable</div><div>set tacacs key <redacted></div><div>!</div></div><div><div>#authentication</div><div>set authentication login tacacs enable telnet primary</div><div>set authentication enable tacacs enable telnet primary</div></div><div>!</div><div><div>#accounting</div><div>set accounting exec enable stop-only tacacs+</div><div>set accounting connect enable stop-only tacacs+</div><div>set accounting system enable stop-only tacacs+</div><div>set accounting commands enable all stop-only tacacs+</div><div>!</div></div><div><div>!</div><div>#authorization</div><div>set authorization exec enable tacacs+ if-authenticated telnet</div><div>set authorization commands enable all tacacs+ if-authenticated telnet</div></div><div><br></div><div><br></div><div>For IOS:</div><div><br></div><div><div>aaa new-model</div><div>!</div><div>!</div><div>aaa authentication username-prompt "Local Username: "</div><div>aaa authentication login default group tacacs+ local</div><div>aaa authentication enable default group tacacs+ enable</div><div>aaa authorization config-commands</div><div>aaa authorization exec default group tacacs+ local</div><div>aaa authorization commands 0 default group tacacs+ if-authenticated</div><div>aaa authorization commands 1 default group tacacs+ if-authenticated</div><div>aaa authorization commands 15 default group tacacs+ if-authenticated</div><div>aaa accounting send stop-record authentication failure</div><div>aaa accounting exec default start-stop group tacacs+</div><div>aaa accounting commands 0 default stop-only group tacacs+</div><div>aaa accounting commands 1 default stop-only group tacacs+</div><div>aaa accounting commands 15 default stop-only group tacacs+</div><div>aaa accounting network default start-stop group tacacs+</div><div>aaa accounting system default start-stop group tacacs+</div><div>!</div><div>!</div><div>!</div><div>aaa session-id common</div></div><div>!</div><div><div>tacacs-server host x.x.x.A</div><div>tacacs-server host x.x.x.B</div><div>tacacs-server directed-request</div><div>tacacs-server key 7 <redacted></div><div>!</div></div><div><br></div><div><br></div><div>For IOS-XR:</div><div><br></div><div><div>tacacs source-interface Loopback0 vrf default</div><div>tacacs-server host x.x.x.A port 49</div><div>!</div><div>tacacs-server host x.x.x.B port 49</div><div>!</div><div>tacacs-server key 7 <redacted></div><div>!<br></div><div><div>aaa accounting exec default start-stop group tacacs+</div><div>aaa accounting system default start-stop group tacacs+</div><div>aaa accounting commands default start-stop group tacacs+</div><div>aaa authorization exec default group tacacs+ local</div><div>aaa authorization commands default group tacacs+ none</div><div>aaa authentication login default group tacacs+ local</div></div></div><div><br></div><div><br></div><div><br></div><div>For NX-OS:</div><div><br></div><div><div>ip tacacs source-interface loopback0</div><div>tacacs-server host x.x.x.A key 7 <redacted></div><div>tacacs-server host x.x.x.B key 7 <redacted></div><div>aaa group server tacacs+ AAA-SERVERS</div><div> server x.x.x.A</div><div> server x.x.x.B</div></div><div><div>aaa authentication login default group AAA-SERVERS</div><div>aaa authorization config-commands default group AAA-SERVERS local</div><div>aaa authorization commands default group AAA-SERVERS local</div><div>aaa accounting default group AAA-SERVERS</div><div>aaa authentication login error-enable</div><div>aaa authentication login ascii-authentication</div></div><div><br></div><div><br></div><div><br></div><div><div>For JUNOS:</div><div><br></div><div><div>set system authentication-order tacplus</div><div>set system authentication-order password</div></div><div><div>set system tacplus-server x.x.x.A secret <redacted></div><div>set system tacplus-server x.x.x.A source-address a.b.c.d</div><div>set system tacplus-server x.x.x.B secret <redacted></div><div>set system tacplus-server x.x.x.B source-address a.b.c.d</div></div><div><div>set system accounting events login</div><div>set system accounting events change-log</div><div>set system accounting events interactive-commands</div><div>set system accounting destination tacplus</div></div><div><div>set system login user remote full-name "Local template for TACACS+ authentication"</div><div>set system login user remote uid 9999</div><div>set system login user remote class super-user</div></div></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div>And here is a working example for tac_plus version F4.0.4.28 with do_auth.py (latest 1.x version from GitHub)... </div><div><br></div><div>And tac_plus.conf:</div><div><br></div><div>#</div><div><div># This is tac_plus.conf</div><div>#</div><div>key = "redacted"</div><div>logging = local7</div><div>accounting syslog</div><div>default authentication = file /etc/passwd<br></div></div><div><br></div><div><div>group = doauthaccess {</div><div> default service = permit</div><div><br></div><div> service = exec {</div><div> priv-lvl = 1</div><div> optional idletime = 30</div><div> optional acl = 2</div><div> shell:roles="\"network-operator vdc-operator\""</div><div> }</div><div><br></div><div> service = junos-exec {</div><div> bug-fix = "first pair is lost"</div><div> local-user-name = "remote"</div><div> allow-commands = "(.*exit)|(show cli auth.*)"</div><div> deny-commands = ".*"</div><div> allow-configuration = ""</div><div> deny-configuration = ""</div><div> }</div></div><div><br></div><div><div> after authorization "/usr/bin/python /opt/sbin/do_auth.py -i $address -u $user -d $name -l /opt/log/do_auth.log -f /opt/etc/tacacs/do_auth.ini"</div><div>}<br></div><div><br></div><div>#<br></div><div># Default user - Used when no user specific stanza exists in tac_plus.conf.</div><div>#</div><div>user = DEFAULT {</div><div> member = doauthaccess</div><div> login = PAM</div><div>}</div><div><br></div><div>user = $enable$ {</div><div> login = des <redacted></div><div>}</div></div><div>#</div><div># End of tac_plus.conf</div><div>#</div><div><br></div><div><br></div><div><br></div><div><br></div><div>And for do_auth.ini:</div><div><br></div><div>#</div><div># This is do_auth.ini</div><div>#</div><div><div>[users]</div><div><br></div><div>## Any user who is not a member of another group inherits<br></div><div>## the privs of the no_authority group.</div><div>default =</div><div> no_authority</div></div><div><br></div><div><div>joeblow =</div><div> no_aaa_commands</div><div><br></div><div><div>##############################</div><div>## ##</div><div>## Default Group ##</div><div>## Undefined users receive ##</div><div>## this group by default ##</div><div>## ##</div><div>##############################</div><div>[no_authority]</div><div>host_deny =</div><div><br></div><div>host_allow =</div><div> .*</div><div><br></div><div>device_deny =</div><div><br></div><div>device_permit =</div><div> .*</div><div><br></div><div>command_deny =</div><div><br></div><div>command_permit =</div><div> exit.*</div><div><br></div><div>av_pairs =</div><div> priv-lvl=1</div><div> shell:roles="network-operator vdc-operator"</div><div> local-user-name = remote</div><div> allow-commands = (.*exit)|(show cli auth.*)</div><div> deny-commands = .*</div><div> allow-configuration =</div><div> deny-configuration =</div></div><div><br></div><div><br></div><div><br></div><div><div>[no_aaa_commands]</div><div>host_deny =</div><div>host_allow =</div><div> .*</div><div>device_deny =</div><div>device_permit =</div><div> .*</div><div>command_deny =</div><div> aaa.*</div><div> no aaa.*</div><div>command_permit =</div><div> .*</div><div>av_pairs =</div><div> priv-lvl=15</div><div> shell:roles="network-admin vdc-admin"</div><div> local-user-name = remote</div><div> allow-commands = .*</div><div> deny-commands =</div><div> allow-configuration = .*</div><div> deny-configuration = (.*system .*accounting.*)|(.*system login.*)|(.*system .*tacplus-options.*)|(.*system .*tacplus-server.*)</div></div><div><br></div><div>#</div><div># End of do_auth.ini</div><div>#</div><div><br></div><div> </div></div><div class="gmail_extra"><br></div><div class="gmail_extra">These are literally copy/pasted from my operational configs with very little redaction. This config works with our very large fleet of CatOS. IOS, IOS-XR, NX-OS, EOS and JUNOS devices.</div><div class="gmail_extra"><br></div><div class="gmail_extra">If this doesn't get you going, give up... `cause there's no hope. ;-)</div><div class="gmail_extra"><br></div><div class="gmail_extra"><br></div><div class="gmail_extra"><div><div class="gmail_signature"><div dir="ltr"><div>--</div>John Fraizer<div>LinkedIn profile: <a href="http://www.linkedin.com/in/johnfraizer/" target="_blank">http://www.linkedin.com/in/johnfraizer/</a></div><div><br><div><span style="color:rgb(53,53,53);font-family:Arial,sans-serif;font-size:12px;line-height:12px;background-color:rgb(244,244,244)"><br></span></div></div></div></div></div>
<br><div class="gmail_quote">On Thu, Aug 6, 2015 at 9:10 AM, <span dir="ltr"><<a href="mailto:Kevin.Cruse@instinet.com" target="_blank">Kevin.Cruse@instinet.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hey Aaron,<br>
<br>
Sorry to keep bothering you - I am pulling my hair out trying to get this<br>
working!! I scrapped the mavvis version and installed the native version of<br>
tac_plus (tac_plus version F4.0.4.28) and authorization seems to fail for<br>
devices, here is my config. Do you see something amiss? I also tried<br>
getting 'do_auth' to work but that doesn't work either.<br>
<span class=""><br>
Arista1#sh run | i aaa<br>
aaa group server tacacs+ CiscoACS<br>
aaa authentication login default group CiscoACS local<br>
</span>aaa authorization exec default group CiscoACS none<br>
aaa authorization commands 0-14 default group CiscoACS local<br>
aaa authorization commands 15 default group CiscoACS none<br>
<span class="">aaa accounting exec default start-stop group CiscoACS<br>
aaa accounting commands all default start-stop group CiscoACS<br>
no aaa root<br>
</span>Arista1#<br>
<span class=""><br>
<br>
group = snm {<br>
default service = deny<br>
</span> default<br>
<span class=""> service = exec {<br>
priv-lvl = 15<br>
}<br>
</span> cmd = show {<br>
permit ip<br>
permit interface<br>
<div><div class="h5"> }<br>
cmd = configure {<br>
deny .*<br>
}<br>
cmd = clear {<br>
permit "counters"<br>
permit "qos stat"<br>
permit "mls qos int"<br>
}<br>
cmd = disable {<br>
permit .*<br>
}<br>
cmd = enable {<br>
permit .*<br>
}<br>
cmd = end {<br>
permit .*<br>
}<br>
cmd = exit {<br>
permit .*<br>
}<br>
cmd = logout {<br>
permit .*<br>
}<br>
cmd = ping {<br>
permit .*<br>
}<br>
cmd = set {<br>
permit "length 0"<br>
}<br>
cmd = show {<br>
deny "controllers vip"<br>
permit .*<br>
}<br>
cmd = skip-page-display {<br>
permit .*<br>
}<br>
cmd = terminal {<br>
permit "length 0"<br>
}<br>
cmd = write {<br>
permit "network"<br>
permit "terminal"<br>
permit "memory"<br>
}<br>
}<br>
<br>
<br>
<br>
user = testuser {<br>
</div></div> login = PAM<br>
member = snm<br>
}<br>
<br>
<br>
!!! router allows commands which should be denied !!<br>
<br>
<br>
Arista1 login: testuser<br>
Password:<br>
Last login: Thu Aug 6 16:12:19 on ttyS0<br>
Arista1>en<br>
Password:<br>
Arista1#configure terminal <-------- Should be denied<br>
Arista1(config)#interface ethernet 10 <----------- Should be denied<br>
Arista1(config-if-Et10)#shut <----------- Should be denied<br>
Arista1(config-if-Et10)#no shut <----------- Should be denied<br>
Arista1(config-if-Et10)#end<br>
Arista1#<br>
<br>
<br>
<br>
!!! SAME EXAMPLE WITH DO_AUTH<br>
<span class=""><br>
<br>
<br>
group = snm {<br>
default service = deny<br>
</span> default<br>
<span class=""> service = exec {<br>
priv-lvl = 15<br>
}<br>
</span> cmd = show {<br>
permit ip<br>
permit interface<br>
<div><div class="h5"> }<br>
cmd = configure {<br>
deny .*<br>
}<br>
cmd = clear {<br>
permit "counters"<br>
permit "qos stat"<br>
permit "mls qos int"<br>
}<br>
cmd = disable {<br>
permit .*<br>
}<br>
cmd = enable {<br>
permit .*<br>
}<br>
cmd = end {<br>
permit .*<br>
}<br>
cmd = exit {<br>
permit .*<br>
}<br>
cmd = logout {<br>
permit .*<br>
}<br>
cmd = ping {<br>
permit .*<br>
}<br>
cmd = set {<br>
permit "length 0"<br>
}<br>
cmd = show {<br>
deny "controllers vip"<br>
permit .*<br>
}<br>
cmd = skip-page-display {<br>
permit .*<br>
}<br>
cmd = terminal {<br>
permit "length 0"<br>
}<br>
cmd = write {<br>
permit "network"<br>
permit "terminal"<br>
permit "memory"<br>
}<br>
</div></div> after authorization "/usr/bin/python /usr/local/sbin/tacplus/do_auth.pyc<br>
-u $user -l /var/log/tacacs/do_auth_log.txt<br>
-f /usr/local/sbin/tacplus/do_auth.ini"<br>
}<br>
<br>
<br>
<br>
<br>
<br>
Arista1 login: testuser<br>
Password:<br>
Last login: Thu Aug 6 16:14:44 on ttyS0<br>
Arista1>en<br>
Password:<br>
Arista1#configure terminal <-------- Should be denied<br>
Arista1(config)#interface ethernet 10 <-------- Should be denied<br>
Arista1(config-if-Et10)#shut <-------- Should be denied<br>
Arista1(config-if-Et10)#no shut<br>
Arista1(config-if-Et10)#end<br>
Arista1#<br>
<br>
<br>
!! When i run the debug to do_auth it just hangs at prompt, meaning it does<br>
not run then hand back the prompt:<br>
<br>
tac01 tacplus $ sudo /usr/bin/python2 /usr/local/sbin/tacplus/do_auth.py -u<br>
$user -l /var/log/tacacs/do_auth_log.txt<br>
-f /usr/local/sbin/tacplus/do_auth.ini -D<br>
<br>
this is what i would expect:<br>
<br>
tac01 tacplus $ sudo /usr/bin/python2 /usr/local/sbin/tacplus/do_auth.py -u<br>
$user -l /var/log/tacacs/do_auth_log.txt<br>
-f /usr/local/sbin/tacplus/do_auth.ini -D<br>
tac01 tacplus $<br>
<br>
<br>
!! do_auth.ini<br>
<br>
tac01 tacplus $ cat do_auth.ini<br>
[users]<br>
kcruse =<br>
snm<br>
[snm]<br>
command_deny =<br>
configure .*<br>
terminal .*<br>
interface .*<br>
shutdown .*<br>
command_permit =<br>
show.*<br>
hcvmtac01 tacplus $<br>
<span class=""><br>
<br>
<br></span></blockquote></div></div></div>