[RADIATOR] Cisco http server with tacacs+ authentication problem
Hugh Irvine
hugh at open.com.au
Mon Jul 7 18:13:31 CDT 2008
Hello Markus -
Here is an example I have been testing recently:
# the first line allows the login at priv-lvl=1
AuthorizeGroup group1 permit service=shell cmd\* {priv-lvl=1}
# the following lines only allow the execution of "show ..." and
"ping ...." commands
AuthorizeGroup group1 permit service=shell cmd=show cmd-arg=.*
AuthorizeGroup group1 permit service=shell cmd=ping cmd-arg=.*
# all other attempts to execute commands will be denied
AuthorizeGroup group1 deny .*
See also the example in "goodies/tacacsplusserver.cfg".
hope that helps
regards
Hugh
On 8 Jul 2008, at 06:18, Markus Moeller wrote:
> Hi
>
> I try to setup tacacs+ authentication/authorization for the http
> sever on a cisco 7200. I read (http://www.cisco.com/warp/public/
> 480/http-1.pdf) I need to return a priv-lvl=15 (not sure if during
> authentication reply or authorization reply). I tried to add a
> reply attribute to both, but looking at a decrypted wireshark trace
> I don't see the reply attribute with the replies. Is that not
> implemented for tacacs+ requests ?
>
> Thank you
> Markus
>
> Config file:
>
> <ServerTACACSPLUS>
> #
> # Attribute for Tacacs Group
> #
> GroupMemberAttr Group-Name
> #
> # cisco group permissions
> #
> AuthorizeGroup ciscoadmin permit service=shell
> AuthorizeGroup ciscoadmin permit service=exec cmd=.* cmd-
> arg=.* {cisco-avpair="priv-lvl=15"}
> </ServerTACACSPLUS>
>
> <AuthBy FILE>
> Identifier UserAuth
> Filename %D/Users
> </AuthBy>
>
> <Handler>
> AuthBy UserAuth
> PostProcessingHook file:"/etc/radiator/set_authorize_group.pl"
> AcctLogFileName %L/accounting-%d-%v-%Y.log
> </Handler>
>
> Users file:
>
> markus User-Password=markus
> cisco-avpair="priv-lvl=15"
>
>
> Log output
>
> Mon Jul 7 21:00:21 2008: DEBUG: New TacacsplusConnection created
> for 192.168.1.200:11198
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection request 192,
> 1, 1, 0, 4271424462, 23
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection
> Authentication START 1, 1, 1 for , tty2, 192.168.1.8
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection
> Authentication REPLY 4, 0, Username: ,
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection request 192,
> 1, 3, 0, 4271424462, 11
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection
> Authentication CONTINUE 0, markus,
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection
> Authentication REPLY 5, 1, Password: ,
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection request 192,
> 1, 5, 0, 4271424462, 11
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection
> Authentication CONTINUE 0, markus,
> Mon Jul 7 21:00:21 2008: DEBUG: TACACSPLUS derived Radius request
> packet dump:
> Code: Access-Request
> Identifier: UNDEF
> Authentic: J<140><156><235><243><225>P<166>6<2><29>Pk<157>B&
> Attributes:
> NAS-IP-Address = 192.168.1.200
> NAS-Port-Id = "tty2"
> Calling-Station-Id = "192.168.1.8"
> Service-Type = Login-User
> User-Name = "markus"
> User-Password = markus
>
> Mon Jul 7 21:00:21 2008: DEBUG: Handling request with Handler ''
> Mon Jul 7 21:00:21 2008: DEBUG: Deleting session for markus,
> 192.168.1.200,
> Mon Jul 7 21:00:21 2008: DEBUG: Handling with Radius::AuthFILE:
> UserAuth
> Mon Jul 7 21:00:21 2008: DEBUG: Radius::AuthFILE looks for match
> with markus [markus]
> Mon Jul 7 21:00:21 2008: DEBUG: Radius::AuthFILE ACCEPT: : markus
> [markus]
> Mon Jul 7 21:00:21 2008: DEBUG: AuthBy FILE result: ACCEPT,
> Mon Jul 7 21:00:21 2008: DEBUG: Access accepted for markus
> Mon Jul 7 21:00:21 2008: DEBUG: Packet dump:
> *** Reply to TACACSPLUS request:
> Code: Access-Accept
> Identifier: UNDEF
> Authentic: J<140><156><235><243><225>P<166>6<2><29>Pk<157>B&
> Attributes:
> Group-Name = ciscoadmin
>
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection result Access-
> Accept
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection
> Authentication REPLY 1, 0, ,
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection disconnected
> from 192.168.1.200:11198
> Mon Jul 7 21:00:21 2008: DEBUG: New TacacsplusConnection created
> for 192.168.1.200:11199
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection request 192,
> 2, 1, 0, 1922248824, 48
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection Authorization
> REQUEST 6, 0, 1, 1, markus, tty2, 192.168.1.8, 2, service=shell cmd*
> Mon Jul 7 21:00:21 2008: DEBUG: AuthorizeGroup rule match found:
> permit service=shell { }
> Mon Jul 7 21:00:21 2008: INFO: Authorization permitted for markus,
> group ciscoadmin, args service=shell cmd*
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection Authorization
> RESPONSE 1, , ,
> Mon Jul 7 21:00:21 2008: DEBUG: TacacsplusConnection disconnected
> from 192.168.1.200:11199
>
> Cisco Tacacs config:
>
> ip http server
> ip http authentication aaa
> aaa new-model
> aaa authentication login default group tacacs+ local
> aaa authentication enable default group tacacs+ enable
> aaa authorization console
> aaa authorization config-commands
> aaa authorization exec default group tacacs+ if-authenticated
> aaa authorization commands 1 default group tacacs+ if-authenticated
> aaa authorization commands 15 default group tacacs+ if-authenticated
> aaa accounting exec default start-stop group tacacs+
> aaa accounting commands 0 default stop-only group tacacs+
> aaa accounting commands 1 default stop-only group tacacs+
> aaa accounting commands 15 default stop-only group tacacs+
> aaa accounting network default start-stop group tacacs+
> aaa accounting connection default start-stop group tacacs+
> tacacs-server host 192.168.1.7
> tacacs-server key cisco
> Cisco authentication/authorization debug:
>
> 1d05h: HTTP: Authentication for url '/' '/' level 15 privless '/'
> 1d05h: HTTP: Authentication username = 'markus' priv-level = 15
> auth-type = aaa
> 1d05h: AAA: parse name=tty2 idb type=-1 tty=-1
> 1d05h: AAA: name=tty2 flags=0x11 type=5 shelf=0 slot=0 adapter=0
> port=2 channel=0
> 1d05h: AAA/MEMORY: create_user (0x625866A8) user='' ruser=''
> port='tty2' rem_addr='192.168.1.8' authen_type=ASCII service=LOGIN
> priv=0
> 1d05h: AAA/AUTHEN/START (4271424462): port='tty2' list=''
> action=LOGIN service=LOGIN
> 1d05h: AAA/AUTHEN/START (4271424462): using "default" list
> 1d05h: AAA/AUTHEN/START (4271424462): Method=tacacs+ (tacacs+)
> 1d05h: TAC+: send AUTHEN/START packet ver=192 id=4271424462
> 1d05h: TAC+: ver=192 id=4271424462 received AUTHEN status = GETUSER
> 1d05h: AAA/AUTHEN (4271424462): status = GETUSER
> 1d05h: AAA/AUTHEN/CONT (4271424462): continue_login (user='(undef)')
> 1d05h: AAA/AUTHEN (4271424462): status = GETUSER
> 1d05h: AAA/AUTHEN (4271424462): Method=tacacs+ (tacacs+)
> 1d05h: TAC+: send AUTHEN/CONT packet id=4271424462
> 1d05h: TAC+: ver=192 id=4271424462 received AUTHEN status = GETPASS
> 1d05h: AAA/AUTHEN (4271424462): status = GETPASS
> 1d05h: AAA/AUTHEN/CONT (4271424462): continue_login (user='markus')
> 1d05h: AAA/AUTHEN (4271424462): status = GETPASS
> 1d05h: AAA/AUTHEN (4271424462): Method=tacacs+ (tacacs+)
> 1d05h: TAC+: send AUTHEN/CONT packet id=4271424462
> 1d05h: TAC+: ver=192 id=4271424462 received AUTHEN status = PASS
> 1d05h: AAA/AUTHEN (4271424462): status = PASS
> 1d05h: tty2 AAA/AUTHOR/HTTP (1922248824): Port='tty2' list=''
> service=EXEC
> 1d05h: AAA/AUTHOR/HTTP: tty2 (1922248824) user='markus'
> 1d05h: tty2 AAA/AUTHOR/HTTP (1922248824): send AV service=shell
> 1d05h: tty2 AAA/AUTHOR/HTTP (1922248824): send AV cmd*
> 1d05h: tty2 AAA/AUTHOR/HTTP (1922248824): found list "default"
> 1d05h: tty2 AAA/AUTHOR/HTTP (1922248824): Method=tacacs+ (tacacs+)
> 1d05h: AAA/AUTHOR/TAC+: (1922248824): user=markus
> 1d05h: AAA/AUTHOR/TAC+: (1922248824): send AV service=shell
> 1d05h: AAA/AUTHOR/TAC+: (1922248824): send AV cmd*
> 1d05h: TAC+: (1922248824): received author response status = PASS_ADD
> 1d05h: AAA/AUTHOR (1922248824): Post authorization status = PASS_ADD
> 1d05h: HTTP: Authentication failed
> 1d05h: AAA/MEMORY: free_user (0x625866A8) user='markus' ruser=''
> port='tty2' rem_addr='192.168.1.8' authen_type=ASCII service=LOGIN
> priv=0
> _______________________________________________
> radiator mailing list
> radiator at open.com.au
> http://www.open.com.au/mailman/listinfo/radiator
NB:
Have you read the reference manual ("doc/ref.html")?
Have you searched the mailing list archive (www.open.com.au/archives/
radiator)?
Have you had a quick look on Google (www.google.com)?
Have you included a copy of your configuration file (no secrets),
together with a trace 4 debug showing what is happening?
Have you checked the RadiusExpert wiki:
http://www.open.com.au/wiki/index.php/Main_Page
--
Radiator: the most portable, flexible and configurable RADIUS server
anywhere. Available on *NIX, *BSD, Windows, MacOS X.
Includes support for reliable RADIUS transport (RadSec),
and DIAMETER translation agent.
-
Nets: internetwork inventory and management - graphical, extensible,
flexible with hardware, software, platform and database independence.
-
CATool: Private Certificate Authority for Unix and Unix-like systems.
More information about the radiator
mailing list