<div dir="ltr">Here is one problem:<div><br></div><div><span style="font-family:sans-serif;background-color:rgb(255,255,0)"><b>cmd exit does not exist, denied by default</b></span></div><div><font face="sans-serif"><br></font><div class="gmail_extra">It looks like you've got default service = deny in your tac_plus.conf. To use do_auth, you need default service = permit.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Your after auth line doesn't look right either.</div><div class="gmail_extra"><br></div><div class="gmail_extra"><b style="font-family:sans-serif">/usr/bin/python /usr/local/sbin/tacplus/do_auth.py -u $user -l /var/log/tacacs/do_auth_log.txt -f /usr/local/sbin/tacplus/do_auth.ini</b><br></div><div class="gmail_extra"><br></div><div class="gmail_extra">You're not giving it the device address or the address of the user attempting to auth. Try changing the after authorization line in tac_plus.conf to:</div><div class="gmail_extra"><br></div><div class="gmail_extra"><b>after authorization "/usr/bin/python /usr/local/sbin/tacplus/do_auth.py -i $address -u $user -d $name -l /tmp/do_auth.log -f /usr/local/sbin/tacplus/do_auth.ini"</b><br></div><div class="gmail_extra"><br></div><div class="gmail_extra">Note that this will create a do_auth specific log in /tmp/do_auth.log but, right now - we'll need that for debugging purposes.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Also remember, you'll need to restart tac_plus for this change to take effect.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Here is an example tac_plus group that I know to work properly with do_auth.py on CatOS, IOS, IOS-XR, NX-OS, EOS and JUNOS:</div><div class="gmail_extra"><br></div><div class="gmail_extra">group = doauthaccess {<br></div><div class="gmail_extra"><div class="gmail_extra"> default service = permit</div><div class="gmail_extra"><br></div><div class="gmail_extra"> service = exec {</div><div class="gmail_extra"> priv-lvl = 1</div><div class="gmail_extra"> optional idletime = 30</div><div class="gmail_extra"> optional acl = 2</div><div class="gmail_extra"> shell:roles="\"network-operator vdc-operator\""</div><div class="gmail_extra"> }</div><div class="gmail_extra"><br></div><div class="gmail_extra"> service = junos-exec {</div><div class="gmail_extra"> bug-fix = "first pair is lost"</div><div class="gmail_extra"> local-user-name = "remote"</div><div class="gmail_extra"> allow-commands = "(.*exit)|(show cli auth.*)"</div><div class="gmail_extra"> deny-commands = ".*"</div><div class="gmail_extra"> allow-configuration = ""</div><div class="gmail_extra"> deny-configuration = ""</div><div class="gmail_extra"> }</div></div><div class="gmail_extra"><div class="gmail_extra">after authorization "/usr/bin/python /usr/local/sbin/tacplus/do_auth.py -i $address -u $user -d $name -l /tmp/do_auth.log -f /usr/local/sbin/tacplus/do_auth.ini"<br></div><div><b>}</b></div><div><b><br></b></div><div><br></div><div>One more thing... Looking at your do_auth.ini, you seem to have a space between the commands and ".*" which should not be there.</div><div><br></div><div>For example:</div><div><br></div><div>exit .*</div><div><br></div><div>...should be:</div><div><br></div><div>exit.*</div><div> </div><div><br></div><div>I posted a complete working tac_plus.conf and do_auth.ini along with the AAA config I use on devices the other day. Take a look at that post as well.</div></div><div class="gmail_extra"><br></div><div class="gmail_extra"><br></div><div class="gmail_extra">--<br></div><div class="gmail_extra"><div><div class="gmail_signature"><div dir="ltr">John Fraizer<div>LinkedIn profile: <a href="http://www.linkedin.com/in/johnfraizer/" target="_blank">http://www.linkedin.com/in/johnfraizer/</a></div><div><br><div><span style="color:rgb(53,53,53);font-family:Arial,sans-serif;font-size:12px;line-height:12px;background-color:rgb(244,244,244)"><br></span></div></div></div></div></div>
<br><div class="gmail_quote">On Fri, Aug 7, 2015 at 5:16 AM, <span dir="ltr"><<a href="mailto:Kevin.Cruse@instinet.com" target="_blank">Kevin.Cruse@instinet.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><p><font size="2" face="sans-serif">I will try upgrading to 4.14.5F and see what happens! thanks</font><br><br><font size="2" face="sans-serif">wondering if you are familiar with this error in do_auth execution, I am permitting exit in do_auth.ini. seems to be some issue with do_auth script:</font><br><br><font size="2" face="sans-serif">Reading config</font><br><font size="2" face="sans-serif">Version F4.0.4.28 Initialized 1</font><br><font size="2" face="sans-serif">tac_plus server F4.0.4.28 starting</font><br><font size="2" face="sans-serif">socket FD 4 AF 2</font><br><font size="2" face="sans-serif">uid=0 euid=0 gid=0 egid=0 s=23660848</font><br><font size="2" face="sans-serif">connect from router1 [172.28.10.124]</font><br><font size="2" face="sans-serif">Start authorization request</font><br><font size="2" face="sans-serif">do_author: user='testuser'</font><br><font size="2" face="sans-serif">user 'testuser' found</font><br><font size="2" face="sans-serif">authorize_cmd: user=testuser, cmd=exit</font><br><font size="2" face="sans-serif">cmd exit does not exist, denied by default</font><br><font size="2" face="sans-serif">After authorization call: /usr/bin/python /usr/local/sbin/tacplus/do_auth.py -u $user -l /var/log/tacacs/do_auth_log.txt -f /usr/local/sbin/tacplus/do_auth.ini</font><br><font size="2" face="sans-serif"><b>substitute: /usr/bin/python /usr/local/sbin/tacplus/do_auth.py -u $user -l /var/log/tacacs/do_auth_log.txt -f /usr/local/sbin/tacplus/do_auth.ini</b></font><br><font size="2" face="sans-serif"><b>Dollar substitution: /usr/bin/python /usr/local/sbin/tacplus/do_auth.py -u testuser -l /var/log/tacacs/do_auth_log.txt -f /usr/local/sbin/tacplus/do_auth.ini</b></font><br><font size="2" face="sans-serif"><b>pid 24672 child exited status 1</b></font><br><font size="2" face="sans-serif">cmd /usr/bin/python /usr/local/sbin/tacplus/do_auth.py -u $user -l /var/log/tacacs/do_auth_log.txt -f /usr/local/sbin/tacplus/do_auth.ini returns 1 (unconditional deny)</font><br><font size="2" face="sans-serif">authorization query for 'testuser' tty130 from router1 rejected</font><br><font size="2" face="sans-serif">connect from router1 [1.1.1.1]</font><br><br><br><font size="2" face="sans-serif">do_auth.ini:</font><br><br><font size="2" face="sans-serif">[users]</font><br><font size="2" face="sans-serif">testuser =</font><span class=""><br><font size="2" face="sans-serif"> snm</font><br><font size="2" face="sans-serif">[snm]</font><br><font size="2" face="sans-serif">command_deny =</font><br><font size="2" face="sans-serif"> configure .*</font><br></span><font size="2" face="sans-serif"> show controllers vip .*</font><br><font size="2" face="sans-serif">command_permit =</font><br><font size="2" face="sans-serif"> show ip .*</font><br><font size="2" face="sans-serif"> show interface .*</font><br><font size="2" face="sans-serif"> clear counters .*</font><br><font size="2" face="sans-serif"> clear qos stat .*</font><br><font size="2" face="sans-serif"> clear mls qos int .*</font><br><font size="2" face="sans-serif"> disable .*</font><br><font size="2" face="sans-serif"> enable .*</font><br><font size="2" face="sans-serif"> end .*</font><br><font size="2" face="sans-serif"> exit .*</font><br><font size="2" face="sans-serif"> logout .*</font><br><font size="2" face="sans-serif"> ping .*</font><br><font size="2" face="sans-serif"> set length .*</font><br><font size="2" face="sans-serif"> show .*</font><br><font size="2" face="sans-serif"> skip-page-display .*</font><br><font size="2" face="sans-serif"> write network .*</font><br><font size="2" face="sans-serif"> write terminal .*</font><br><font size="2" face="sans-serif"> write memory .*</font><br><br><br><br><br><img width="16" height="16" src="cid:1__=0ABBF409DFD162FB8f9e@AMERICAS.CORP.LOCAL" border="0" alt="Inactive hide details for John Fraizer ---08/06/2015 06:54:05 PM---I'm not sure when this command became available in EOS but, "><font size="2" color="#424282" face="sans-serif">John Fraizer ---08/06/2015 06:54:05 PM---I'm not sure when this command became available in EOS but, at least in 4.14.5F, you will get what y</font><br><br><font size="1" color="#5F5F5F" face="sans-serif">From: </font><font size="1" face="sans-serif">John Fraizer <<a href="mailto:john@op-sec.us" target="_blank">john@op-sec.us</a>></font><br><font size="1" color="#5F5F5F" face="sans-serif">To: </font><font size="1" face="sans-serif">"Kevin.Cruse@Instinet.com" <<a href="mailto:Kevin.Cruse@instinet.com" target="_blank">Kevin.Cruse@instinet.com</a>>, </font><br><font size="1" color="#5F5F5F" face="sans-serif">Cc: </font><font size="1" face="sans-serif">Daniel Schmidt <<a href="mailto:daniel.schmidt@wyo.gov" target="_blank">daniel.schmidt@wyo.gov</a>>, "<a href="mailto:tac_plus@shrubbery.net" target="_blank">tac_plus@shrubbery.net</a>" <<a href="mailto:tac_plus@shrubbery.net" target="_blank">tac_plus@shrubbery.net</a>></font><br><font size="1" color="#5F5F5F" face="sans-serif">Date: </font><font size="1" face="sans-serif">08/06/2015 06:54 PM</font><span class=""><br><font size="1" color="#5F5F5F" face="sans-serif">Subject: </font><font size="1" face="sans-serif">Re: [tac_plus] Cisco Nexus Authorization problem</font><br></span></p><hr width="100%" size="2" align="left" noshade style="color:#8091a5"><div><div class="h5"><br><br><br><font size="3" face="serif">I'm not sure when this command became available in EOS but, at least in 4.14.5F, you will get what you want with:</font><br><br><font size="2" color="#500050" face="serif">aaa authorization commands all default group tacacs+ none</font><br><br><br><font size="3" face="serif">--</font><br><font size="3" face="serif">John Fraizer</font><br><font size="3" face="serif">LinkedIn profile: </font><a href="http://www.linkedin.com/in/johnfraizer/" target="_blank"><font size="3" color="#0000FF" face="serif"><u>http://www.linkedin.com/in/johnfraizer/</u></font></a><br><br><br><br><font size="3" face="serif">On Thu, Aug 6, 2015 at 1:58 PM, <</font><a href="mailto:Kevin.Cruse@instinet.com" target="_blank"><font size="3" color="#0000FF" face="serif"><u>Kevin.Cruse@instinet.com</u></font></a><font size="3" face="serif">> wrote:</font><ul style="padding-left:9pt"><font size="3" face="serif">tried that! arista only takes this command with no arguments:<br><br>aaa authorization config-commands<br><br>it still didn't work.<br><br>fyi - i just tried same config with cisco router and it works perfectly,<br>running 4.13.11M of EOS.<br><br><br><br>From: Daniel Schmidt <</font><a href="mailto:daniel.schmidt@wyo.gov" target="_blank"><font size="3" color="#0000FF" face="serif"><u>daniel.schmidt@wyo.gov</u></font></a><font size="3" face="serif">><br>To: </font><a href="mailto:Kevin.Cruse@instinet.com" target="_blank"><font size="3" color="#0000FF" face="serif"><u>Kevin.Cruse@instinet.com</u></font></a><font size="3" face="serif">,<br>Cc: Aaron Wasserott <</font><a href="mailto:aaron.wasserott@viawest.com" target="_blank"><font size="3" color="#0000FF" face="serif"><u>aaron.wasserott@viawest.com</u></font></a><font size="3" face="serif">>,<br> "</font><a href="mailto:tac_plus@shrubbery.net" target="_blank"><font size="3" color="#0000FF" face="serif"><u>tac_plus@shrubbery.net</u></font></a><font size="3" face="serif">" <</font><a href="mailto:tac_plus@shrubbery.net" target="_blank"><font size="3" color="#0000FF" face="serif"><u>tac_plus@shrubbery.net</u></font></a><font size="3" face="serif">><br>Date: 08/06/2015 04:09 PM<br>Subject: Re: [tac_plus] Cisco Nexus Authorization problem</font><br><font size="3" face="serif"><br><br><br>This part of the email looks interesting:<br><br>But if you<br>want them in conf t mode but restrict their commands at that level, you<br>need to enable something like this:<br><br>aaa authorization config-commands default group myTacacsGroup local<br></font><br></ul></div></div><font face="sans-serif"><div style="font-size:12px;font-style:italic;font-family:georgia,arial,sans-serif">
<br><span class=""><br>
=========================================================================================================
<div style="font-size:12px;font-style:italic;font-family:georgia,arial,sans-serif">
<p>
<b><<<< Disclaimer >>>></b>
</p><p>
This message is intended solely for use by the named addressee(s). If you receive this transmission in error, please immediately notify the sender and destroy this message in its entirety, whether in electronic or hard copy format. Any unauthorized use (and reliance thereon), copying, disclosure, retention, or distribution of this transmission or the material in this transmission is forbidden. We reserve the right to monitor and archive electronic communications. This material does not constitute an offer or solicitation with respect to the purchase or sale of any security. It should not be construed to contain any recommendation regarding any security or strategy. Any views expressed are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. This communication is provided on an “as is” basis. It contains material that is owned by Instinet Incorporated, its subsidiaries or its or their licensors, and may not, in whole or in part, be (i) copied, photocopied or duplicated in any form, by any means, or (ii) redistributed, posted, published, excerpted, or quoted without Instinet Incorporated's prior written consent. Please access the following link for important information and instructions: <a href="http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt" target="_blank"> http://instinet.com/includes/index.jsp?thePage=/html/le_index.txt</a>
</p><p>
Securities products and services are provided by locally registered brokerage subsidiaries of Instinet Incorporated: Instinet Australia Pty Limited (ACN: 131 253 686 AFSL No: 327834), regulated by the Australian Securities & Investments Commission; Instinet Canada Limited, member IIROC/CIPF; Instinet Pacific Limited, authorized and regulated by the Securities and Futures Commission of Hong Kong; Instinet Singapore Services Private Limited, regulated by the Monetary Authority of Singapore, trading member of The Singapore Exchange Securities Trading Private Limited and clearing member of The Central Depository (Pte) Limited; and Instinet, LLC, member SIPC.
</p><p>
<br><br>
=========================================================================================================
</p><p></p><p></p><p></p></div></span></div></font>
<p></p></div>
</blockquote></div><br></div></div></div>