2

I have two Ubuntu workstations which I want to configure to use our TACACS+ server for logon rather than their local accounts. How do I configure the workstation to use the tacacs servers?

6
  • 1
    Guide: networking-forum.com/blog/?p=200 man page for daemon configuration file: manpages.ubuntu.com/manpages/precise/man5/tac_plus.conf.5.html Another guide: dalikin.wordpress.com/2009/08/31/… Have at least a look at the 1st 2 links and when you face a problem that has no clear solution ask away :)
    – Rinzwind
    Nov 15, 2012 at 15:49
  • @Rinzwind Why don't you put all that information into an answer?
    – Lucio
    Dec 1, 2012 at 15:38
  • @lucio cuz I never have had a tacacs+ server so I do not know for sure if those links work on Ubuntu. You can have the rep if you c/p it though ;)
    – Rinzwind
    Dec 1, 2012 at 17:21
  • @Rinzwind What do you mean with c/p? I don't understand the popular English's abbreviations, for the time being. :-)
    – Lucio
    Dec 1, 2012 at 18:50
  • @lucio copy/paste ;)
    – Rinzwind
    Dec 1, 2012 at 20:00

4 Answers 4

1

There, I found interesting project - tacacsGUI.com. It is self-hosted front-end UI for tac_plus configuration. My installation was easy, try it. Plus it has some advantages like Backup Maker for auto backup, Subnet searcher for subnets collection etc. Good luck!

0

I hope you don't mind but I'd just like to add this info for others...

I was able to get xtacacs Version 4.0 working for authentication on a Ubuntu 12.04.02 LTS 64 bit system, with a Cisco AS2511 only after I compiled it in 32bit mode (gcc -m32 ...). If I compiled it to the default 64bit target, it got all sorts of weird errors, like syslog showing that username 'chris' was transposed to 'hcris'.

Of course I had to load the 32bit system libraries (sudo apt-get install ia32-libs) and the 32bit header files (sudo apt-get install gcc-multilib) first.

0

See ServerFault Post Authenticate Linux sshd with TACACS+ (Cisco ACS)

Install the server

  1. Add the linux server's hostname / ip address into Cisco ACS and restart the Cisco ACS service
  2. Download the tacacs+ PAM module from SourceForge.
  3. Install pam development package for your linux distro. RHEL / CentOS call it pam-devel; Debian / Ubuntu call it libpam-dev (a virtual package name for libpam0g-dev).
  4. Untar the tacacs+ pam module into a temporary working directory
  5. cd into the new folder created by tar.
  6. As root: ./configure; make; make install
  7. As root, edit /etc/pam.d/sshd, and add this line as the first entry in the file:

    auth include tacacs

  8. As root, create a new file called /etc/pam.d/tacacs:

    #%PAM-1.0
    auth       sufficient   /usr/local/lib/security/pam_tacplus.so debug server=192.0.2.27 secret=d0nttr3@d0nm3
    account    sufficient   /usr/local/lib/security/pam_tacplus.so debug server=192.0.2.27 secret=d0nttr3@d0nm3 service=shell protocol=ssh
    session    sufficient   /usr/local/lib/security/pam_tacplus.so debug server=192.0.2.27 secret=d0nttr3@d0nm3 service=shell protocol=ssh

Per-Server / Per-user Instructions

As root on each server, create a local linux user account that matches the tacacs+ username for all required users. The users can optionally use passwd to set their local password to whatever they like as a last resort; however, if they set a local password, they will be able to login locally at any time without tacacs+ even if the service is available.

pam_tacplus Service information

The details of how the pam_tacplus.so module works are in this pam-list archived email

0

Below config is usefull to user authenticate without having users in linux machine.

auth      sufficient   pam_unix.so try_first_pass nullok
auth      required     pam_krb5.so use_first_pass no_user_check

account   sufficient   pam_unix.so
account   required     pam_krb5.so no_user_check
account   optional     pam_permit.so
account   required     pam_time.so

password  sufficient   pam_unix.so try_first_pass nullok sha512 shadow
password  required     pam_krb5.so use_authtok no_user_check

session   required     pam_limits.so
session   optional     pam_permit.so

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .