[tac_plus] Nexus

[Daniel Schmidt]

Ok, I got it working, I also have it set so it can find/replace pairs based
on groups.  Slight change to do_auth - you DO have to strip the first 2
pairs just like ios, but they are not identical.  (cmd* vs cmd=)  Will post
that change soon.  This would solve all Alan's problem, if Alan could be
convinced to try do_auth.  ;-)

The only thing I don't understand is why none of the default roles seem to
be restricted.  I could conf t & change an int desc with role-0 and
network-operator.  Are all the default roles useless or am I missing
something?  The only place I could see a role being "not cumbersome and
useless" was if you defined one for a VDC giving a user rights only to a
specific VDC.  THAT is the only thing I can't do easier with do_auth and
authorization.

[root at cwacs ~]# tail -n 11 log2.txt
service=shell
cmd=
shell:roles="network-operator"
idletime=3
timeout=15
Nexus pairs found
not len(the_command) > 0
Returning:shell:roles="priv-0"
Returning:idletime=3
Returning:timeout=15
2011-11-16 09:35:31: User 'tester' granted access to <yada yada>

5k# show user- tester
user:tester
        roles:priv-0
account created through REMOTE authentication
Credentials such as ssh server key will be cached temporarily only for this
user account
Local login not possible

5k# show role name priv-0

Role: priv-0
  Description: This is a system defined privilege role.
  vsan policy: permit (default)
  Vlan policy: permit (default)
  Interface policy: permit (default)
  Vrf policy: permit (default)
  -------------------------------------------------------------------
  Rule    Perm    Type        Scope               Entity
  -------------------------------------------------------------------
  10      permit  command                         traceroute6 *
  9       permit  command                         traceroute *
  8       permit  command                         telnet6 *
  7       permit  command                         telnet *
  6       permit  command                         ping6 *
  5       permit  command                         ping *
  4       permit  command                         ssh6 *
  3       permit  command                         ssh *
  2       permit  command                         enable *
  1       permit  read

-----Original Message-----
From: tac_plus-bounces at shrubbery.net [mailto:tac_plus-bounces at shrubbery.net]
On Behalf Of Alan McKinnon
Sent: Wednesday, November 02, 2011 3:46 PM
To: tac_plus at shrubbery.net
Subject: Re: [tac_plus] Nexus

On Wed, 2 Nov 2011 12:55:21 -0600
Daniel Schmidt <daniel.schmidt at wyo.gov> wrote:

> I have updated the do_auth.py authentication script to handle nexus,
> thus it can provide the same multiple group authentication it
> provides on other Cisco devices.   (or at least provide an example)
> I have not been able to pass a role tac_pair successfully – please
> post if you have any progress with this.

tac_plus requires it in this form:

                shell:roles="\"level1\""

Yes, you see it right. Two levels of double quotes, inner pair escaped

Many brain cells died in agony to discover that one :-)

>
>
>
> I had success with the nexus with the following config: (Note that
> many of the commands you traditionally look for are available)
>
>
>
> !Command: show running-config aaa
>
> !Time: Wed Oct 26 18:28:46 2011
>
>
>
> version 5.0(3)N1(1c)
>
> aaa authentication login default group private
>
> aaa authorization config-commands default group private
>
> aaa authorization commands default group private
>
> aaa accounting default group private
>
>
>
> As was discussed previously, the nexus seems to authenticate pap.  No
> clue why Cisco did this; putting pap user names in the tac_plus.conf
> fixes login issues.   Also, the resulting accounting file is
> different so if you have written cgi scripts to parse your accounting
> log, be prepared to rewrite them.


--
Alan McKinnnon
alan.mckinnon at gmail.com
_______________________________________________
tac_plus mailing list
tac_plus at shrubbery.net
http://www.shrubbery.net/mailman/listinfo.cgi/tac_plus
E-Mail to and from me, in connection with the transaction 
of public business,is subject to the Wyoming Public Records 
Act, and may be disclosed to third parties.