openswitch/tacacs_server repository overview

⁠Tags Information

• 1.0 -> TACACS+ server with the configuration mentioned below
• 2.0 -> TACACS server + tcpdump
• 3.0 -> TACACS server + tcpdump + ethtool
• 4.0 -> TACACS+ server (from tag 1.0) with updated configuration
• 4.1 -> TACACS+ server (from tag 4.0) with accounting file created at the default location mentioned in the tac_plus.conf file (i.e. /var/log/tac_plus/tac_plus.acct)
• 5.0 -> Client's IPv6 address was not displayed properly in the accounting logs. Fixed the code to make this work.
• 6.0-> Updated kernel and installed ntp
• latest -> same as 6.0

⁠TACACS+ Server Configuration

Here's a snapshot of the TACACS+ server configuration on the server:

root@559a1265ca1c:/# cat /etc/tacacs/tac_plus.conf

⁠Encryption key

key = "tac_test"

⁠Set where to send accounting records

default authentication = file /etc/passwd accounting syslog; accounting file = /var/log/tac_plus/tac_plus.acct

⁠ACL for network_admin group

acl = network_admin { # allow access from all sources permit = .* # implicit deny (ie: anything else) }

⁠ACL for sys_admin group

acl = sys_admin { # allow access from 10.10.10.250 only permit = .* # permit = ^10.10.10.2$ # implicit deny (ie: anything else) }

⁠network_admin group, full access to network devices

group = network_admin {
    default service = permit
acl = network_admin
    service = exec {
     priv-lvl = 14
    }

}

⁠sys_admin group, only has read access to the network devices and can change the access vlan on an interface

group = sys_admin {
    default service = deny
expires = "Jan 1 2015"
acl = sys_admin
    service = exec {
	priv-lvl = 0
}
cmd = enable {
	permit .*
}
cmd = show {
	permit .*
}
cmd = exit {
	permit .*
}
cmd = configure {
	permit .*
}
cmd = interface {
	permit Ethernet.*
	permit FastEthernet.*
	permit GigabitEthernet.*
}
cmd =  switchport  {
	permit "access vlan.*"
	permit "trunk encapsulation.*"
	permit "mode.*"
	permit "trunk allowed vlan.*"
}
cmd = description {
	permit .*
}

cmd = no {
	permit shutdown
}

}

#user1 user = user1 { pap = cleartext user1 service = exec { priv-lvl = 14 security-role = security-admin } }

#user2 user = user2 { pap = cleartext user2 service = exec { priv-lvl = 15 } }

#user3 user = user3 { chap = cleartext user3 service = exec { priv-lvl = 14 } }

#user4 user = user4 { chap = cleartext user4 }

⁠User jonathanm using DES password and enable passwords

user = jonathanm { member = network_admin login = des 6/1aYAL9zcCe. enable = des dBFJQefS4S4Jw }

⁠User bob authenticating from the system /etc/passwd and the default enable password

user = bob { login = file /etc/passwd member = sys_admin service = exec { priv-lvl = 11 } }

user = netop { login = file /etc/passwd member = network_admin }

user = admin { pap = cleartext admin member = network_admin }