<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Yeah, I was trying and finally got that to work, but I had a couple of questions/observations.<div class=""><br class=""></div><div class="">Why does the “default service = permit” need to be the first statement in the user profile (or else it doesn’t parse)?</div><div class=""><br class=""></div><div class="">And do you have to have a “default service” or can you explicitly permit just named services?</div><div class=""><br class=""></div><div class="">-Philip</div><div class=""><br class=""></div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Oct 18, 2016, at 11:46 AM, Daniel Schmidt <<a href="mailto:daniel.schmidt@wyo.gov" class="">daniel.schmidt@wyo.gov</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">Don't you need a default service = permit in there somewhere?<br class=""></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Mon, Oct 17, 2016 at 2:40 PM, Philip Prindeville <span dir="ltr" class=""><<a href="mailto:philipp@redfish-solutions.com" target="_blank" class="">philipp@redfish-solutions.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi.<br class="">
<br class="">
I’m banging on the source to pam_tacplus’s libtac library and tacc (a simple test program) and I’m trying to figure out if the source to that is broken or if I’m invoking the test code incorrectly or if the configuration that I’m using for testing is wrong.<br class="">
<br class="">
Here’s the config file that I have:<br class="">
<br class="">
key = "password"<br class="">
accounting file = /var/log/tac.acct<br class="">
<br class="">
user = fred {<br class="">
login = cleartext "wilma"<br class="">
name = "Fred Flintstone"<br class="">
# member = guest<br class="">
expires = "May 23 2020"<br class="">
<br class="">
service = exec {<br class="">
"acl" = 5<br class="">
<br class="">
autocmd = "telnet foo"<br class="">
}<br class="">
}<br class="">
<br class="">
group = guest {<br class="">
expires = "May 1 2017"<br class="">
}<br class="">
<br class="">
<br class="">
and when I do an authorization query against it, this is the resultant logging:<br class="">
<br class="">
Oct 17 13:35:46 type=AUTHOR, priv_lvl=0, authen=1<br class="">
Oct 17 13:35:46 method=tacacs+<br class="">
Oct 17 13:35:46 svc=3 user_len=4 port_len=5 rem_addr_len=7<br class="">
Oct 17 13:35:46 arg_cnt=2<br class="">
Oct 17 13:35:46 User:<br class="">
Oct 17 13:35:46 fred<br class="">
Oct 17 13:35:46 port:<br class="">
Oct 17 13:35:46 pts/2<br class="">
Oct 17 13:35:46 rem_addr:<br class="">
Oct 17 13:35:46 1.2.3.4<br class="">
Oct 17 13:35:46 arg[0]: size=12<br class="">
Oct 17 13:35:46 service=exec<br class="">
Oct 17 13:35:46 arg[1]: size=11<br class="">
Oct 17 13:35:46 protocol=ip<br class="">
Oct 17 13:35:46 End packet<br class="">
Oct 17 13:35:46 Start authorization request<br class="">
Oct 17 13:35:46 cfg_get_value: name=fred isuser=1 attr=acl rec=1<br class="">
Oct 17 13:35:46 cfg_get_pvalue: returns NULL<br class="">
Oct 17 13:35:46 do_author: user='fred'<br class="">
Oct 17 13:35:46 cfg_get_value: name=fred isuser=1 attr=before rec=1<br class="">
Oct 17 13:35:46 cfg_get_pvalue: returns NULL<br class="">
Oct 17 13:35:46 user 'fred' found<br class="">
Oct 17 13:35:46 cfg_get_svc_node: username=fred N_svc proto= svcname=exec rec=1<br class="">
Oct 17 13:35:46 cfg_get_svc_node: returns NULL<br class="">
Oct 17 13:35:46 cfg_get_value: name=fred isuser=1 attr=svc_dflt rec=1<br class="">
Oct 17 13:35:46 cfg_get_intvalue: returns 0<br class="">
Oct 17 13:35:46 svc=N_svc protocol= not found, denied by default<br class="">
Oct 17 13:35:46 cfg_get_value: name=fred isuser=1 attr=after rec=1<br class="">
Oct 17 13:35:46 cfg_get_pvalue: returns NULL<br class="">
Oct 17 13:35:46 Writing AUTHOR/FAIL size=18<br class="">
<br class="">
<br class="">
What am I missing?<br class="">
<br class="">
Thanks,<br class="">
<br class="">
-Philip<br class="">
<br class="">
______________________________<wbr class="">_________________<br class="">
tac_plus mailing list<br class="">
<a href="mailto:tac_plus@shrubbery.net" class="">tac_plus@shrubbery.net</a><br class="">
<a href="http://www.shrubbery.net/mailman/listinfo/tac_plus" rel="noreferrer" target="_blank" class="">http://www.shrubbery.net/<wbr class="">mailman/listinfo/tac_plus</a><br class="">
</blockquote></div><br class=""></div>
<br class="">
<br class="">E-Mail to and from me, in connection with the transaction <br class="">of public business, is subject to the Wyoming Public Records <br class="">Act and may be disclosed to third parties.<br class=""></div></blockquote></div><br class=""></div></body></html>