Still working away on a project (not for real life deployment so don't worry about seeing passwords).
I have a Tacacs server set up for centralised AAA. I am trying to set up two users, "admin" with full administrative access and "basic" with limited command access. This works perfectly for my ASA firewall however I also want to enable this on an IOS based router.
This works on the router as far as logging in as the users and prompts correctly for a password for enable. However when I try to use commands when logged in as "basic" which should be forbidden they are permitted. From a Wireshark trace I can see that the router is not attempting to contact the tacacs server for authorization of commands. What do I need to add/change to make the router look to the server for command authorization?
Router Config:
!
! Last configuration change at 20:03:48 GMT Mon Nov 29 2021 by basic
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname HQ
!
boot-start-marker
boot-end-marker
!
!
!
aaa new-model
!
!
aaa authentication login default group tacacs+ local
aaa authentication login HQTACACS group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization commands 1 default group tacacs+
aaa authorization commands 15 default group tacacs+
!
!
!
!
!
aaa session-id common
clock timezone GMT 0 0
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
!
!
!
!
!
!
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
username localadmin privilege 15 secret 5 $1$mX0o$aBpVy.ik5ak8ev4wq9IRf1
!
redundancy
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
no shutdown
description TO THE ISP-HQ NETWORK 209.165.200.224/30
ip address 209.165.200.226 255.255.255.224
!
interface Ethernet0/1
no shutdown
description TO THE HQ NETWORK 192.168.10.0/24
ip address 192.168.20.1 255.255.255.252
!
interface Ethernet0/2
no shutdown
no ip address
shutdown
!
interface Ethernet0/3
no shutdown
no ip address
shutdown
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 10.1.1.0 255.255.255.252 Ethernet0/0
ip route 10.1.10.0 255.255.255.0 Ethernet0/0
ip route 192.31.7.32 255.255.255.224 Ethernet0/0
ip route 192.168.10.10 255.255.255.255 192.168.20.2
ip route 198.133.219.0 255.255.255.252 Ethernet0/0
ip route 209.165.200.227 255.255.255.255 192.168.20.2
ip route 209.165.200.228 255.255.255.255 192.168.20.2
!
!
!
tacacs-server directed-request
tacacs server HQTACACS
address ipv4 192.168.10.10
key testing123
!
!
!
control-plane
!
!
!
!
!
!
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
transport input none
!
!
end
Tacacs Server Config:
# Created by Henry-Nicolas Tourneur([email protected])
# See man(5) tac_plus.conf for more details
# Define where to log accounting data, this is the default.
accounting file = /var/log/tac_plus.acct
# This is the key that clients have to use to access Tacacs+
key = testing123
# Use /etc/passwd file to do authentication
#default authentication = file /etc/passwd
# You can use feature like per host key with different enable passwords
#host = 127.0.0.1 {
# key = test
# type = cisco
# enable = <des|cleartext> enablepass
# prompt = "Welcome XXX ISP Access Router \n\nUsername:"
#}
# We also can define local users and specify a file where data is stored.
# That file may be filled using tac_pwd
#user = test1 {
# name = "Test User"
# member = staff
# login = file /etc/tacacs/tacacs_passwords
#}
# We can also specify rules valid per group of users.
#group = group1 {
# cmd = conf {
# deny
# }
#}
# Another example : forbid configure command for some hosts
# for a define range of clients
#group = group1 {
# login = PAM
# service = ppp
# protocol = ip {
# addr = 10.10.0.0/24
# }
# cmd = conf {
# deny .*
# }
#}
user = admin {
default service = permit
member = admingroup
login = cleartext Cisco
enable = cleartext Cisco
}
user = basic {
login = cleartext Cisco
member = readonly
enable = cleartext Cisco
}
group = admingroup {
default service = permit
service = exec {
priv-lvl = 15
}
}
group = readonly {
default service = deny
service = exec {
priv-lvl = 0
}
cmd = show {
permit .*
}
cmd = traceroute {
permit .*
}
cmd = ping {
permit .*
}
cmd = exit {
permit .*
}
}
# Much more features are availables, like ACL, more service compatibilities,
# commands authorization, scripting authorization.
# See the man page for those features.
Edited Config as per answer now contains lines:
aaa authentication login default group tacacs+ local
aaa authentication login HQTACACS group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization commands 1 HQTACACS group tacacs+
aaa authorization commands 15 HQTACACS group tacacs+
But still gives the same behaviour?
Update 2:
I don't have a server group defined, HQTACACS is the server name. The line in the config using it that way looks like a mistake by me. Login authentication and enable mode authentication work with this structure
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
However when I use the same structure (with the correction to use level 0 not 1, thanks Ricky) I can see with wireshark that using either the priv level 15 "admin" and priv level 0 "basic" account that not authrization is being attempted.
aaa authorization commands 0 default group tacacs+
aaa authorization commands 15 default group tacacs+
Do I need a server group defined to use Tacacs for authorization?
