[tac_plus] Install with do_auth

Daniel Schmidt daniel.schmidt at wyo.gov
Thu Jan 19 21:54:12 UTC 2017


What manner of router?  Are you running authorization on the router?  (Not
authentication, authorization)  What's your aa config look like?

On Wed, Jan 18, 2017 at 8:39 AM, <Kevin.Cruse at instinet.com> wrote:

> If I run this:
>
>  /usr/bin/python /usr/local/sbin/tacplus/do_auth.py -i $address
> -fix_crs_bug -u $user -d $name -l /var/log/tacacs/do_auth_log -f
> /usr/local/sbin/tacplus/do_auth.ini -D
>
> it works! The log file is updated, however, the problem still persists
> where it does not updated when run with 'after authorization'. I ran an
> strace on the tac_plus daemon and it never attempts to write to the do_auth
> log file. Something very quirky is going on here. I also checked the log
> file and saw no attempts to access it from any process. It definitely seems
> to be something wrong with the daemon.
>
> -----------------------------------------------------------------
> *Kevin Cruse*
> US Networks
> Instinet LLC
> 309 West 49th Street
> New York, NY 10019 US
> kevin.cruse at instinet.com
> 212-310-4734 <(212)%20310-4734>
>
>
> [image: Inactive hide details for Daniel Schmidt ---01/17/2017 04:41:21
> PM---We're on 1.13 actually. Try that. https://github.com/jath]Daniel
> Schmidt ---01/17/2017 04:41:21 PM---We're on 1.13 actually.  Try that.
> https://github.com/jathanism/do_auth
>
> From: Daniel Schmidt <daniel.schmidt at wyo.gov>
> To: Kevin.Cruse at instinet.com,
> Cc: "tac_plus at shrubbery.net" <tac_plus at shrubbery.net>, tac_plus <
> tac_plus-bounces at shrubbery.net>
> Date: 01/17/2017 04:41 PM
> Subject: Re: Install with do_auth
> ------------------------------
>
>
>
> We're on 1.13 actually.  Try that.
> *https://github.com/jathanism/do_auth*
> <https://github.com/jathanism/do_auth>
>
>
> Off of the top of my head, this here:
> /usr/bin/python /usr/local/sbin/tacplus/do_auth.py -i $address
> -fix_crs_bug -u $user -d $name -l /var/log/tacacs/do_auth_log -f
> /usr/local/sbin/tacplus/do_auth.ini
>
> Run that as your tac_plus user,  fill in your values and add -D.  See if
> it gives you some output or an error.  And you probably don't need
> -fix_crs_bug if you upgrade as I believe Jathan fixed that kludge.
>
>
>
> On Tue, Jan 17, 2017 at 12:50 PM, <*Kevin.Cruse at instinet.com*
> <Kevin.Cruse at instinet.com>> wrote:
>
>    I am in the process of migrating to centos 7 and have setup the
>    following environment:
>
>    CentOS Linux release 7.2.1511
>    tac_plus version F4.0.4.28
>    do_auth.py v1.9
>
>    The problem I am having is users will authenticate properly to
>    tac_plus, however, the 'after authorization' is never called and user ends
>    up with full control on router. It's been awhile since I setup our centos 6
>    servers with tacplus and wonder if I need to build from source with
>    specific switches to support do auth? I cannot for the life of me figure
>    out why 'after authorization' is not called! I've copied the same config
>    from production (currently working perfectly) and cannot get this to work.
>    Any ideas/thoughts/suggestions? im banging my head on this one.
>
>     group = default_group {
>            default service = permit
>            service = exec {
>            priv-lvl = 0
>            shell:roles=\"\\"network-operator\\""
>            }
>            after authorization "/usr/bin/python
>    /usr/local/sbin/tacplus/do_auth.py -i $address -fix_crs_bug -u $user
>    -d $name -l /var/log/tacacs/do_auth_log -f /usr/local/sbin/tacplus/do_
>    auth.ini"
>
>     }
>
>
>    Thanks
>
>    -----------------------------------------------------------------
> * Kevin Cruse*
>    US Networks
>    Instinet LLC
>    309 West 49th Street
>    New York, NY 10019 US
> *kevin.cruse at instinet.com* <kevin.cruse at instinet.com>
> *212-310-4734* <(212)%20310-4734>
>
>
>
> *
>    =========================================================================================================
>    *
>
>    *<<<< Disclaimer >>>>*
>
>    *This message, including all attachments, is private and confidential,
>    may contain proprietary or privileged information and material and is
>    intended solely for use by the named addressee(s). If you receive this
>    transmission in error, please immediately notify the sender and destroy
>    this message in its entirety, whether in electronic or hard copy format.
>    Any unauthorized use (and reliance thereon), copying, disclosure,
>    retention, or distribution of this transmission or the material herein is
>    forbidden. We reserve the right to retain, monitor, intercept and archive
>    electronic communications. This message does not constitute an offer or
>    solicitation with respect to the purchase or sale of any security. It
>    should not be construed to contain any recommendation regarding any
>    security or strategy unless expressly stated therein. Any reference to the
>    terms of executed transactions should be treated as preliminary only and
>    subject to formal written confirmation. Any views expressed are those of
>    the individual sender, except where the message states otherwise and the
>    sender is authorized to state them to be the views of any such entity. This
>    message is provided on an “as is” basis. It contains material that is owned
>    by Instinet Incorporated, its subsidiaries or its or their licensors, and
>    may not, in whole or in part, be (i) copied, photocopied or duplicated in
>    any form, by any means, or (ii) redistributed, posted, published,
>    excerpted, or quoted without Instinet Incorporated's prior written consent.
>    No confidentiality or privilege is waived or lost by any mistransmission of
>    this message. Instinet, LLC (member SIPC) and Instinet Canada Limited
>    (member IIROC/CIPF) are subsidiaries of Instinet Incorporated that are
>    locally registered or otherwise authorized to provide securities brokerage
>    products and services. Please refer to the following link for additional
>    disclosures and disclaimers that apply to this message: *
>    *http://instinet.com/docs/legal/le_disclaimers.html.*
>    <http://instinet.com/docs/legal/le_disclaimers.html>* Effective July
>    1, 2014, Canada introduced Canadian Anti-Spam Legislation ("CASL"). As a
>    Canadian resident you are receiving this electronic communication because
>    of your existing relationship with Instinet Canada Limited ("ICL") or an
>    authorized affiliate. Canadian residents who wish to unsubscribe from
>    commercial electronic messages: please e-mail *
>    *iclcompliance at instinet.com* <iclcompliance at instinet.com>*. Please
>    note that you will continue to receive non-commercial electronic messages,
>    such as account statements, invoices, client communications, and other
>    similar factual electronic communications. *
>
>
>
> *
>    =========================================================================================================
>    *
>
>
>
>
>
>
> E-Mail to and from me, in connection with the transaction
> of public business, is subject to the Wyoming Public Records
> Act and may be disclosed to third parties.
>
>
> ============================================================
> =============================================
>
> *<<<< Disclaimer >>>>*
>
> This message, including all attachments, is private and confidential, may
> contain proprietary or privileged information and material and is intended
> solely for use by the named addressee(s). If you receive this transmission
> in error, please immediately notify the sender and destroy this message in
> its entirety, whether in electronic or hard copy format. Any unauthorized
> use (and reliance thereon), copying, disclosure, retention, or distribution
> of this transmission or the material herein is forbidden. We reserve the
> right to retain, monitor, intercept and archive electronic communications.
> This message does not constitute an offer or solicitation with respect to
> the purchase or sale of any security. It should not be construed to contain
> any recommendation regarding any security or strategy unless expressly
> stated therein. Any reference to the terms of executed transactions should
> be treated as preliminary only and subject to formal written confirmation.
> Any views expressed are those of the individual sender, except where the
> message states otherwise and the sender is authorized to state them to be
> the views of any such entity. This message is provided on an “as is” basis.
> It contains material that is owned by Instinet Incorporated, its
> subsidiaries or its or their licensors, and may not, in whole or in part,
> be (i) copied, photocopied or duplicated in any form, by any means, or (ii)
> redistributed, posted, published, excerpted, or quoted without Instinet
> Incorporated's prior written consent. No confidentiality or privilege is
> waived or lost by any mistransmission of this message. Instinet, LLC
> (member SIPC) and Instinet Canada Limited (member IIROC/CIPF) are
> subsidiaries of Instinet Incorporated that are locally registered or
> otherwise authorized to provide securities brokerage products and services.
> Please refer to the following link for additional disclosures and
> disclaimers that apply to this message: http://instinet.com/docs/
> legal/le_disclaimers.html.
> <http://instinet.com/docs/legal/le_disclaimers.html> Effective July 1,
> 2014, Canada introduced Canadian Anti-Spam Legislation ("CASL"). As a
> Canadian resident you are receiving this electronic communication because
> of your existing relationship with Instinet Canada Limited ("ICL") or an
> authorized affiliate. Canadian residents who wish to unsubscribe from
> commercial electronic messages: please e-mail iclcompliance at instinet.com.
> Please note that you will continue to receive non-commercial electronic
> messages, such as account statements, invoices, client communications, and
> other similar factual electronic communications.
>
>
>
> ============================================================
> =============================================
>
>

-- 

E-Mail to and from me, in connection with the transaction 
of public business, is subject to the Wyoming Public Records 
Act and may be disclosed to third parties.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.shrubbery.net/pipermail/tac_plus/attachments/20170119/20f47e19/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 21671581.gif
Type: image/gif
Size: 4077 bytes
Desc: not available
URL: <http://www.shrubbery.net/pipermail/tac_plus/attachments/20170119/20f47e19/attachment.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: graycol.gif
Type: image/gif
Size: 105 bytes
Desc: not available
URL: <http://www.shrubbery.net/pipermail/tac_plus/attachments/20170119/20f47e19/attachment-0001.gif>


More information about the tac_plus mailing list