2

Still working away on a project (not for real life deployment so don't worry about seeing passwords).

I have a Tacacs server set up for centralised AAA. I am trying to set up two users, "admin" with full administrative access and "basic" with limited command access. This works perfectly for my ASA firewall however I also want to enable this on an IOS based router.

This works on the router as far as logging in as the users and prompts correctly for a password for enable. However when I try to use commands when logged in as "basic" which should be forbidden they are permitted. From a Wireshark trace I can see that the router is not attempting to contact the tacacs server for authorization of commands. What do I need to add/change to make the router look to the server for command authorization?

Router Config:


!
! Last configuration change at 20:03:48 GMT Mon Nov 29 2021 by basic
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname HQ
!
boot-start-marker
boot-end-marker
!
!
!
aaa new-model
!
!
aaa authentication login default group tacacs+ local
aaa authentication login HQTACACS group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization commands 1 default group tacacs+ 
aaa authorization commands 15 default group tacacs+ 
!
!
!
!
!
aaa session-id common
clock timezone GMT 0 0
mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180
!
!
!
!
!
!
!
!


!
!
!
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
username localadmin privilege 15 secret 5 $1$mX0o$aBpVy.ik5ak8ev4wq9IRf1
!
redundancy
!
!
! 
!
!
!
!
!
!
!
!
!
!
!
!
interface Ethernet0/0
 no shutdown
 description TO THE ISP-HQ NETWORK 209.165.200.224/30
 ip address 209.165.200.226 255.255.255.224
!
interface Ethernet0/1
 no shutdown
 description TO THE HQ NETWORK 192.168.10.0/24
 ip address 192.168.20.1 255.255.255.252
!
interface Ethernet0/2
 no shutdown
 no ip address
 shutdown
!
interface Ethernet0/3
 no shutdown
 no ip address
 shutdown
!
ip forward-protocol nd
!
!
no ip http server
no ip http secure-server
ip route 10.1.1.0 255.255.255.252 Ethernet0/0
ip route 10.1.10.0 255.255.255.0 Ethernet0/0
ip route 192.31.7.32 255.255.255.224 Ethernet0/0
ip route 192.168.10.10 255.255.255.255 192.168.20.2
ip route 198.133.219.0 255.255.255.252 Ethernet0/0
ip route 209.165.200.227 255.255.255.255 192.168.20.2
ip route 209.165.200.228 255.255.255.255 192.168.20.2
!
!
!
tacacs-server directed-request
tacacs server HQTACACS
 address ipv4 192.168.10.10
 key testing123
!
!
!
control-plane
!
!
!
!
!
!
!
!
line con 0
 logging synchronous
line aux 0
line vty 0 4
 transport input none
!
!
end

Tacacs Server Config:

# Created by Henry-Nicolas Tourneur(henry.nicolas@tourneur.be)
# See man(5) tac_plus.conf for more details
 
# Define where to log accounting data, this is the default.
 
accounting file = /var/log/tac_plus.acct
 
# This is the key that clients have to use to access Tacacs+
 
key = testing123
 
# Use /etc/passwd file to do authentication
 
#default authentication = file /etc/passwd
 
 
# You can use feature like per host key with different enable passwords
#host = 127.0.0.1 {
#        key = test 
#        type = cisco
#        enable = <des|cleartext> enablepass
#        prompt = "Welcome XXX ISP Access Router \n\nUsername:"
#}
 
# We also can define local users and specify a file where data is stored.
# That file may be filled using tac_pwd
#user = test1 {
#    name = "Test User"
#    member = staff
#    login = file /etc/tacacs/tacacs_passwords
#}
 
# We can also specify rules valid per group of users.
#group = group1 {
#   cmd = conf {
#       deny
#   }
#}
 
# Another example : forbid configure command for some hosts
# for a define range of clients
#group = group1 {
#   login = PAM
#   service = ppp
#   protocol = ip {
#       addr = 10.10.0.0/24
#   }
#   cmd = conf {
#       deny .*
#   }
#}
 
user = admin {
    default service = permit
    member = admingroup
    login = cleartext Cisco
    enable = cleartext Cisco
}
 
user = basic {
    login = cleartext Cisco
    member = readonly
    enable = cleartext Cisco
}
 
group = admingroup {
    default service = permit
    service = exec {
        priv-lvl = 15
    }
}
 
group = readonly {
    default service = deny
    service = exec {
        priv-lvl = 0
    }
 
 
    cmd = show {
        permit .*
    }
 
    cmd = traceroute {
        permit .*
    }
 
    cmd = ping {
        permit .*
    }
 
    cmd = exit {
        permit .*
    }
}
 
# Much more features are availables, like ACL, more service compatibilities,
# commands authorization, scripting authorization.
# See the man page for those features.

Edited Config as per answer now contains lines:

aaa authentication login default group tacacs+ local
aaa authentication login HQTACACS group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization commands 1 HQTACACS group tacacs+ 
aaa authorization commands 15 HQTACACS group tacacs+

But still gives the same behaviour?

Update 2:

I don't have a server group defined, HQTACACS is the server name. The line in the config using it that way looks like a mistake by me. Login authentication and enable mode authentication work with this structure

aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable

However when I use the same structure (with the correction to use level 0 not 1, thanks Ricky) I can see with wireshark that using either the priv level 15 "admin" and priv level 0 "basic" account that not authrization is being attempted.

aaa authorization commands 0 default group tacacs+
aaa authorization commands 15 default group tacacs+

Do I need a server group defined to use Tacacs for authorization?

3
  • "debug aaa" to see what's being sent for those logins. If the user is priv "0", you've not defined a command group for them.
    – Ricky
    Nov 30 '21 at 0:21
  • Thanks for the tip on priv level 0. "debug aaa" doesnt seem to be accepted as a command? I've been using wireshark to see if requests are sent to the server or not.
    – DavidM
    Nov 30 '21 at 16:39
  • 1
    "debug aaa ?" will show the slew of options for what to watch. You'll also need the console or syslog logging setup to show debug messages.
    – Ricky
    Nov 30 '21 at 21:27
4

Edited:

You use the group tacacs+ for your authentication, but you have not configured a server group for that. Here is a corrected configuration:

aaa authentication login default group HQTACACS local
aaa authentication enable default group HQTACACS enable
aaa authorization commands 0 default group HQTACACS if-authenticated
aaa authorization commands 15 default group HQTACACS if-authenticated

additional:

aaa group server tacacs+ HQTACACS
 server name HQTACACS

Update 2:

If connected via the console (not vty), you need this additional line:

aaa authorization console
10
  • 1
    "default" is the correct word. You aren't associating the "HQTACACS" policy to anything.
    – Ricky
    Nov 30 '21 at 0:20
  • 1
    @DavidM Revised the configuration.
    – Ron Trunk
    Nov 30 '21 at 13:32
  • 1
    @DavidM See additional commands
    – Ron Trunk
    Nov 30 '21 at 17:37
  • 1
    You say non-privileged user can run all commands? That points to a different problem. Does it persist if you turn off aaa?
    – Ron Trunk
    Nov 30 '21 at 18:51
  • 1
    Let us continue this discussion in chat.
    – Ron Trunk
    Nov 30 '21 at 19:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.