{"id":1956,"date":"2011-04-12T19:46:03","date_gmt":"2011-04-12T19:46:03","guid":{"rendered":"http:\/\/wiki.freeiz.com\/?p=1956"},"modified":"2016-08-09T12:08:39","modified_gmt":"2016-08-09T12:08:39","slug":"centralizing-logins-with-tacacs","status":"publish","type":"post","link":"https:\/\/wiki-see.info\/wp\/2011\/04\/12\/centralizing-logins-with-tacacs\/","title":{"rendered":"Centralizing Logins with TACACS+"},"content":{"rendered":"

C<\/span>onfiguring TACACS<\/span>+<\/span><\/strong> can be a bit of a challenge if you have never done it before.
\nBut once you understand the format of the config file its really pretty simple<\/span>.<\/p>\n

Here’s a sample tacacs+ config<\/span> :<\/p>\n

# Encryption key is the same key you configure in your router\n# ENCYPTION KEY:<\/span>\n\tkey = password<\/em><\/span>\n\n# You will want to log access to a file. Set that file here\n# Remember to rotate the log, it will grow over time.\n# write accounting to:<\/span>\n\taccounting file = accounting.log<\/span>\n\n#########################################\n###############Users#####################\n#########################################<\/span>\n\n### without \"login = \" need to authenticate through radius or local:\n\n\tuser \t= tom <\/span>\t\t{ member = itnetwork<\/span> }\n\tuser \t= dick<\/span>\t\t{ member = itnetwork<\/span> }\n\tuser \t= harry\t<\/span>\t{ member = itnetwork<\/span> }\n<\/span>\n\tuser\t= backup-user\t{ member = show } # show profile for only doing backups<\/span>\n\n################################\n##########Groups################\n################################<\/span>\n\ngroup = itnetwork<\/span> {\n\t\t# IT-Network Engineers\n        login = file passwords.db\n\n\t\tservice\t= exec {\n\t\t\tdefault attribute = permit\n\t\t\tpriv-lvl = 15<\/span>\n\t\t}\n\ncmd = show {\n                permit .*\n                }\ncmd = enable {\n                permit .*\n                }\n#################################################\n# The remainder edited for breavity<\/span><\/pre>\n
In the above sample config there are basically three sections.\u00a0 The top section of the config is
\nwhere you define the encryption key <\/span><\/em>that allows your routers and switches to authenticate to
\nyour tacacs+ server.<\/span><\/p>\n
The next section is the users section.\u00a0 This is where you define the user names , which group they
\nare a member of<\/span>, and where the password<\/span> is kept.\u00a0 In this example we are using a file called
\npasswords.db<\/span><\/em> that contains these passwords<\/span>.<\/span><\/p>\n
Finally is the group section<\/span>.\u00a0 This is where you define the commands that can be executed by
\nthis group<\/span>. Users can belong to multiple groups<\/span>.\u00a0 Commands can be permitted<\/span> or denied<\/span> which
\nallows for an amazing amount of control over what users and groups can do on your network devices.<\/span><\/p>\n
While TAC+ runs on the server, enter this command on the server to see the entries that go into the
\naccounting file:<\/span><\/p>\n
tail -f \/var\/log\/tac.log <\/span><\/p>\n
For more advanced features check out Cisco Secure ACS Server.<\/strong><\/span><\/p>\n
 <\/strong><\/p>\n
The entire tacacs+ package can be <\/span>downloaded here<\/a>. <\/span> It contains the entire tac.cfg file<\/span><\/span><\/strong><\/p>\n
 <\/strong><\/div>\n","protected":false},"excerpt":{"rendered":"
Configuring TACACS+ can be a bit of a challenge if you have never done it before. But once you understand the format of the config file its really pretty simple. Here’s a sample tacacs+ config : # Encryption key is the same key you configure in your router # ENCYPTION KEY: key = password # […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[666],"class_list":["post-1956","post","type-post","status-publish","format-standard","hentry","category-linux","tag-tacacs"],"_links":{"self":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/1956","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/comments?post=1956"}],"version-history":[{"count":1,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/1956\/revisions"}],"predecessor-version":[{"id":5091,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/posts\/1956\/revisions\/5091"}],"wp:attachment":[{"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/media?parent=1956"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/categories?post=1956"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wiki-see.info\/wp\/wp-json\/wp\/v2\/tags?post=1956"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}