[tac_plus] TACACS Solution?

[Matt Almgren]

Yup Yup, I realized after sending that and reading John’s reply.

We use them both, so I got them mixed up.

Thanks, Matt






From: John Fraizer <john at op-sec.us<mailto:john at op-sec.us>>
Date: Friday, July 24, 2015 at 2:15 PM
To: Matt Almgren <matta at surveymonkey.com<mailto:matta at surveymonkey.com>>
Cc: "Chase, John" <john.chase at rakuten.com<mailto:john.chase at rakuten.com>>, "tac_plus at shrubbery.net<mailto:tac_plus at shrubbery.net>" <tac_plus at shrubbery.net<mailto:tac_plus at shrubbery.net>>
Subject: Re: [tac_plus] TACACS Solution?

TAC_PLUS is a TACACS+ daemon.  It is going to provide a AAA
(Authentication, Authorization & Accounting) solution for you.  It
does NOT synchronize or examine router/switch configurations.  For
that, you will need something else - such as RANCID.

On Fri, Jul 24, 2015 at 1:33 PM, Matt Almgren <matta at surveymonkey.com<mailto:matta at surveymonkey.com>> wrote:
1.2.2 Secure and synchronize router configuration files.
1.2.2.a Examine router configuration files to verify they are secured from unauthorized access.
1.2.2.b Examine router configurations to verify they are synchronized—for example, the running (or active) configuration matches the start-up configuration (used when machines are booted)

While the running (or active) router configuration files include the current, secure settings, the startup files (which are used when routers are restarted or booted) must be updated with the same secure settings to ensure these settings are applied when the start-up configuration is run. Because they only run occasionally, start-up configuration files are often forgotten and are not updated. When a router re-starts and loads a start-up configuration that has not been updated with the same secure settings as those in the running configuration, it may result in weaker rules that allow malicious individuals into the network.

Unless I’m missing something, that’s all our auditor told us we need to be concerned with.  TAC+ handles all of it nicely.



--
John Fraizer
LinkedIn profile: http://www.linkedin.com/in/johnfraizer/

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/tac_plus/attachments/20150724/0cc72b91/attachment.html>