<div dir="ltr">What manner of router? Are you running authorization on the router? (Not authentication, authorization) What's your aa config look like? <br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 18, 2017 at 8:39 AM, <span dir="ltr"><<a href="mailto:Kevin.Cruse@instinet.com" target="_blank">Kevin.Cruse@instinet.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><p><font size="2" face="sans-serif">If I run this:</font><br><br><font size="2" face="sans-serif"> /usr/bin/python /usr/local/sbin/tacplus/do_<wbr>auth.py -i $address -fix_crs_bug -u $user -d $name -l /var/log/tacacs/do_auth_log -f /usr/local/sbin/tacplus/do_<wbr>auth.ini -D</font><br><br><font size="2" face="sans-serif">it works! The log file is updated, however, the problem still persists where it does not updated when run with 'after authorization'. I ran an strace on the tac_plus daemon and it never attempts to write to the do_auth log file. Something very quirky is going on here. I also checked the log file and saw no attempts to access it from any process. It definitely seems to be something wrong with the daemon.<br></font></p><p><span class=""><font size="2" color="#707070" face="MS Sans Serif">------------------------------<wbr>------------------------------<wbr>-----</font><br><font size="1" color="#707070" face="Arial"><b>Kevin Cruse</b></font><font size="1" color="#707070" face="Arial"><br>US Networks<br>Instinet LLC<br>309 West 49th Street<br>New York, NY 10019 US<br><a href="mailto:kevin.cruse@instinet.com" target="_blank">kevin.cruse@instinet.com</a><br><a href="tel:(212)%20310-4734" value="+12123104734" target="_blank">212-310-4734</a></font><br><img src="cid:1__=0ABB0A3FDFC655F98f9e@AMERICAS.CORP.LOCAL" width="155" height="45"><br><br></span><img src="cid:2__=0ABB0A3FDFC655F98f9e@AMERICAS.CORP.LOCAL" alt="Inactive hide details for Daniel Schmidt ---01/17/2017 04:41:21 PM---We're on 1.13 actually. Try that. https://github.com/jath" border="0" width="16" height="16"><font size="2" color="#424282" face="sans-serif">Daniel Schmidt ---01/17/2017 04:41:21 PM---We're on 1.13 actually. Try that. <a href="https://github.com/jathanism/do_auth" target="_blank">https://github.com/jathanism/<wbr>do_auth</a></font><br><br><font size="1" color="#5F5F5F" face="sans-serif">From: </font><font size="1" face="sans-serif">Daniel Schmidt <<a href="mailto:daniel.schmidt@wyo.gov" target="_blank">daniel.schmidt@wyo.gov</a>></font><br><font size="1" color="#5F5F5F" face="sans-serif">To: </font><font size="1" face="sans-serif"><a href="mailto:Kevin.Cruse@instinet.com" target="_blank">Kevin.Cruse@instinet.com</a>, </font><br><font size="1" color="#5F5F5F" face="sans-serif">Cc: </font><font size="1" face="sans-serif">"<a href="mailto:tac_plus@shrubbery.net" target="_blank">tac_plus@shrubbery.net</a>" <<a href="mailto:tac_plus@shrubbery.net" target="_blank">tac_plus@shrubbery.net</a>>, tac_plus <<a href="mailto:tac_plus-bounces@shrubbery.net" target="_blank">tac_plus-bounces@shrubbery.<wbr>net</a>></font><br><font size="1" color="#5F5F5F" face="sans-serif">Date: </font><font size="1" face="sans-serif">01/17/2017 04:41 PM</font><br><font size="1" color="#5F5F5F" face="sans-serif">Subject: </font><font size="1" face="sans-serif">Re: Install with do_auth</font><br></p><hr style="color:#8091a5" width="100%" noshade size="2" align="left"><div><div class="h5"><br><br><br><font size="3" face="serif">We're on 1.13 actually. Try that. </font><br><a href="https://github.com/jathanism/do_auth" target="_blank"><font size="3" color="#0000FF" face="serif"><u>https://github.com/jathanism/<wbr>do_auth</u></font></a><font size="3" face="serif"><br></font><br><font size="3" face="serif"><br>Off of the top of my head, this here:</font><font size="2" face="sans-serif"><br>/usr/bin/python /usr/local/sbin/tacplus/do_<wbr>auth.py -i $address -fix_crs_bug -u $user -d $name -l /var/log/tacacs/do_auth_log -f /usr/local/sbin/tacplus/do_<wbr>auth.ini</font><br><br><font size="2" face="sans-serif">Run that as your tac_plus user, fill in your values and add -D. See if it gives you some output or an error. And you probably don't need -fix_crs_bug if you upgrade as I believe Jathan fixed that kludge. </font><br><br><br><br><font size="3" face="serif">On Tue, Jan 17, 2017 at 12:50 PM, <</font><a href="mailto:Kevin.Cruse@instinet.com" target="_blank"><font size="3" color="#0000FF" face="serif"><u>Kevin.Cruse@instinet.com</u></font></a><font size="3" face="serif">> wrote:</font><ul style="padding-left:9pt"><font size="2" face="sans-serif">I am in the process of migrating to centos 7 and have setup the following environment:</font><font size="3" face="serif"><br></font><font size="2" face="sans-serif"><br>CentOS Linux release 7.2.1511 <br>tac_plus version F4.0.4.28<br>do_auth.py v1.9</font><font size="3" face="serif"><br></font><font size="2" face="sans-serif"><br>The problem I am having is users will authenticate properly to tac_plus, however, the 'after authorization' is never called and user ends up with full control on router. It's been awhile since I setup our centos 6 servers with tacplus and wonder if I need to build from source with specific switches to support do auth? I cannot for the life of me figure out why 'after authorization' is not called! I've copied the same config from production (currently working perfectly) and cannot get this to work. Any ideas/thoughts/suggestions? im banging my head on this one.</font><font size="3" face="serif"><br></font><font size="2" face="sans-serif"><br> group = default_group {<br> default service = permit<br> service = exec {<br> priv-lvl = 0<br> shell:roles=\"\\"network-<wbr>operator\\""<br> }<br> after authorization "/usr/bin/python /usr/local/sbin/tacplus/do_<wbr>auth.py -i $address -fix_crs_bug -u $user -d $name -l /var/log/tacacs/do_auth_log -f /usr/local/sbin/tacplus/do_<wbr>auth.ini"<br> <br> }</font><font size="3" face="serif"><br><br></font><font size="2" face="sans-serif"><br>Thanks</font><p><font size="2" color="#707070" face="MS Sans Serif">------------------------------<wbr>------------------------------<wbr>-----</font><font size="1" color="#707070" face="Arial"><b><br>Kevin Cruse</b></font><font size="1" color="#707070" face="Arial"><br>US Networks<br>Instinet LLC<br>309 West 49th Street<br>New York, NY 10019 US</font><font size="1" color="#0000FF" face="Arial"><u><br></u></font><a href="mailto:kevin.cruse@instinet.com" target="_blank"><font size="1" color="#0000FF" face="Arial"><u>kevin.cruse@instinet.com</u></font></a><font size="1" color="#0000FF" face="Arial"><u><br></u></font><a href="tel:(212)%20310-4734" target="_blank"><font size="1" color="#0000FF" face="Arial"><u>212-310-4734</u></font></a><font size="3" face="serif"><br></font><img src="cid:1__=0ABB0A3FDFC655F98f9e@AMERICAS.CORP.LOCAL" width="155" height="45"></p><p><font size="1" face="sans-serif"><i><br><br>==============================<wbr>==============================<wbr>==============================<wbr>=============== </i></font></p><p><font size="1" face="Georgia"><b><i><<<< Disclaimer >>>></i></b></font><font size="1" face="Georgia"><i> </i></font></p><p><font size="1" face="Georgia"><i>This message, including all attachments, is private and confidential, may contain proprietary or privileged information and material and is intended solely for use by the named addressee(s). If you receive this transmission in error, please immediately notify the sender and destroy this message in its entirety, whether in electronic or hard copy format. Any unauthorized use (and reliance thereon), copying, disclosure, retention, or distribution of this transmission or the material herein is forbidden. We reserve the right to retain, monitor, intercept and archive electronic communications. This message does not constitute an offer or solicitation with respect to the purchase or sale of any security. It should not be construed to contain any recommendation regarding any security or strategy unless expressly stated therein. Any reference to the terms of executed transactions should be treated as preliminary only and subject to formal written confirmation. Any views expressed are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. This message is provided on an “as is” basis. It contains material that is owned by Instinet Incorporated, its subsidiaries or its or their licensors, and may not, in whole or in part, be (i) copied, photocopied or duplicated in any form, by any means, or (ii) redistributed, posted, published, excerpted, or quoted without Instinet Incorporated's prior written consent. No confidentiality or privilege is waived or lost by any mistransmission of this message. Instinet, LLC (member SIPC) and Instinet Canada Limited (member IIROC/CIPF) are subsidiaries of Instinet Incorporated that are locally registered or otherwise authorized to provide securities brokerage products and services. Please refer to the following link for additional disclosures and disclaimers that apply to this message: </i></font><a href="http://instinet.com/docs/legal/le_disclaimers.html" target="_blank"><font size="1" color="#0000FF" face="Georgia"><i><u>http://instinet.com/docs/<wbr>legal/le_disclaimers.html.</u></i></font></a><font size="1" face="Georgia"><i> <wbr>Effective July 1, 2014, Canada introduced Canadian Anti-Spam Legislation ("CASL"). As a Canadian resident you are receiving this electronic communication because of your existing relationship with Instinet Canada Limited ("ICL") or an authorized affiliate. Canadian residents who wish to unsubscribe from commercial electronic messages: please e-mail </i></font><a href="mailto:iclcompliance@instinet.com" target="_blank"><font size="1" color="#0000FF" face="Georgia"><i><u>iclcompliance@instinet.com</u></i></font></a><font size="1" face="Georgia"><i>. Please note that you will continue to receive non-commercial electronic messages, such as account statements, invoices, client communications, and other similar factual electronic communications. </i></font></p><p><font size="1" face="Georgia"><i><br><br>==============================<wbr>==============================<wbr>==============================<wbr>=============== </i></font></p><p></p><p></p><p></p><p></p></ul><br><br></div></div><font size="3" face="serif"><br><br>E-Mail to and from me, in connection with the transaction <br>of public business, is subject to the Wyoming Public Records <br>Act and may be disclosed to third parties.</font><span class=""><br><font face="sans-serif"><div style="font-size:12px;font-style:italic;font-family:georgia,arial,sans-serif">
<br><br>
==============================<wbr>==============================<wbr>==============================<wbr>===============
<div style="font-size:12px;font-style:italic;font-family:georgia,arial,sans-serif">
<p>
<b><<<< Disclaimer >>>></b>
</p><p>
This message, including all attachments, is private and confidential, may contain proprietary or privileged information and material and is intended solely for use by the named addressee(s). If you receive this transmission in error, please immediately notify the sender and destroy this message in its entirety, whether in electronic or hard copy format. Any unauthorized use (and reliance thereon), copying, disclosure, retention, or distribution of this transmission or the material herein is forbidden. We reserve the right to retain, monitor, intercept and archive electronic communications. This message does not constitute an offer or solicitation with respect to the purchase or sale of any security. It should not be construed to contain any recommendation regarding any security or strategy unless expressly stated therein. Any reference to the terms of executed transactions should be treated as preliminary only and subject to formal written confirmation. Any views expressed are those of the individual sender, except where the message states otherwise and the sender is authorized to state them to be the views of any such entity. This message is provided on an “as is” basis. It contains material that is owned by Instinet Incorporated, its subsidiaries or its or their licensors, and may not, in whole or in part, be (i) copied, photocopied or duplicated in any form, by any means, or (ii) redistributed, posted, published, excerpted, or quoted without Instinet Incorporated's prior written consent. No confidentiality or privilege is waived or lost by any mistransmission of this message. Instinet, LLC (member SIPC) and Instinet Canada Limited (member IIROC/CIPF) are subsidiaries of Instinet Incorporated that are locally registered or otherwise authorized to provide securities brokerage products and services. Please refer to the following link for additional disclosures and disclaimers that apply to this message: <a href="http://instinet.com/docs/legal/le_disclaimers.html" target="_blank">http://instinet.com/docs/<wbr>legal/le_disclaimers.html.</a> Effective July 1, 2014, Canada introduced Canadian Anti-Spam Legislation ("CASL"). As a Canadian resident you are receiving this electronic communication because of your existing relationship with Instinet Canada Limited ("ICL") or an authorized affiliate. Canadian residents who wish to unsubscribe from commercial electronic messages: please e-mail <a href="mailto:iclcompliance@instinet.com" target="_blank">iclcompliance@instinet.com</a>. Please note that you will continue to receive non-commercial electronic messages, such as account statements, invoices, client communications, and other similar factual electronic communications.
</p><p>
<br><br>
==============================<wbr>==============================<wbr>==============================<wbr>===============
</p><p></p><p></p></div></div></font>
</span><p></p><p></p></div>
</blockquote></div><br></div>
<br>
<br>E-Mail to and from me, in connection with the transaction <br>of public business, is subject to the Wyoming Public Records <br>Act and may be disclosed to third parties.<br>