I have two Ubuntu workstations which I want to configure to use our TACACS+ server for logon rather than their local accounts. How do I configure the workstation to use the tacacs servers?
4 Answers
There, I found interesting project - tacacsGUI.com. It is self-hosted front-end UI for tac_plus configuration. My installation was easy, try it. Plus it has some advantages like Backup Maker for auto backup, Subnet searcher for subnets collection etc. Good luck!
I hope you don't mind but I'd just like to add this info for others...
I was able to get xtacacs Version 4.0 working for authentication on a Ubuntu 12.04.02 LTS 64 bit system, with a Cisco AS2511 only after I compiled it in 32bit mode (gcc -m32 ...). If I compiled it to the default 64bit target, it got all sorts of weird errors, like syslog showing that username 'chris' was transposed to 'hcris'.
Of course I had to load the 32bit system libraries (sudo apt-get install ia32-libs) and the 32bit header files (sudo apt-get install gcc-multilib) first.
See ServerFault Post Authenticate Linux sshd with TACACS+ (Cisco ACS)
Install the server
- Add the linux server's hostname / ip address into Cisco ACS and restart the Cisco ACS service
- Download the tacacs+ PAM module from SourceForge.
- Install
pam
development package for your linux distro. RHEL / CentOS call itpam-devel
; Debian / Ubuntu call itlibpam-dev
(a virtual package name forlibpam0g-dev
). - Untar the tacacs+
pam
module into a temporary working directory cd
into the new folder created bytar
.- As root:
./configure; make; make install
As root, edit
/etc/pam.d/sshd
, and add this line as the first entry in the file:auth include tacacs
As root, create a new file called
/etc/pam.d/tacacs
:
#%PAM-1.0 auth sufficient /usr/local/lib/security/pam_tacplus.so debug server=192.0.2.27 secret=d0nttr3@d0nm3 account sufficient /usr/local/lib/security/pam_tacplus.so debug server=192.0.2.27 secret=d0nttr3@d0nm3 service=shell protocol=ssh session sufficient /usr/local/lib/security/pam_tacplus.so debug server=192.0.2.27 secret=d0nttr3@d0nm3 service=shell protocol=ssh
Per-Server / Per-user Instructions
As root on each server, create a local linux user account that matches the tacacs+ username for all required users. The users can optionally use passwd
to set their local password to whatever they like as a last resort; however, if they set a local password, they will be able to login locally at any time without tacacs+
even if the service is available.
pam_tacplus Service information
The details of how the pam_tacplus.so
module works are in this pam-list
archived email
Below config is usefull to user authenticate without having users in linux machine.
auth sufficient pam_unix.so try_first_pass nullok
auth required pam_krb5.so use_first_pass no_user_check
account sufficient pam_unix.so
account required pam_krb5.so no_user_check
account optional pam_permit.so
account required pam_time.so
password sufficient pam_unix.so try_first_pass nullok sha512 shadow
password required pam_krb5.so use_authtok no_user_check
session required pam_limits.so
session optional pam_permit.so
c/p
? I don't understand the popular English's abbreviations, for the time being. :-)