topic Eddy, in Network Access Control

Remove user-account in n9k from AAA remote auth

eddychristian10 — Mon, 11 Mar 2019 06:32:07 GMT

I have configured AAA authentication using RADIUS in N9k.

It works fine for first login but after that it fails. I suspect because the user-account in n9k cached it as network-operator.

After the first login, i configured the radius server to reply using network-admin role.

show user-account

user:testuser
roles:network-operator
account created through REMOTE authentication
Credentials such as ssh server key will be cached temporarily only for this user
account
Local login not possible

Is there a way to remove this user-account or setup a timeout?

Eddy,

Javier Henderson — Tue, 01 Mar 2016 12:30:39 GMT

Eddy,

Can you please enable debugs for aaa authentication and radius on the Nexus, then log in twice (i.e., a successful and a failed attempt) and show us the output?

Javier Henderson

Cisco Systems

Below the output:

eddychristian10 — Wed, 02 Mar 2016 09:46:12 GMT

Below the output for failed attempt.

I need to get the user to try again using other username.

016 Mar 1 06:57:19 TWR5_SVR_RM_9300_1 %AUTHPRIV-3-SYSTEM_MSG: Unable to create
temporary user testuser. Error 0x404a000a usermod: group 'testuser' does not exist
r/home/admin/.ssh/admin': File exists (100663296) - login[807]
2016 Mar 1 06:57:19 TWR5_SVR_RM_9300_1 %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authenti
cation failed for user testuser from 172.16.74.23 - login[807]
2016 Mar 1 06:57:28 TWR5_SVR_RM_9300_1 %AUTHPRIV-3-SYSTEM_MSG: Unable to create
temporary user testuser. Error 0x404a000a usermod: group 'testuser' does not exist
(100663296) - login[807]
2016 Mar 1 06:57:28 TWR5_SVR_RM_9300_1 %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authenti
cation failed for user testuser from 172.16.74.23 - login[807]
2016 Mar 1 06:57:59 TWR5_SVR_RM_9300_1 %AUTHPRIV-2-SYSTEM_MSG: pam_unix(login:s
ession): close_session - error recovering username - login[807]
2016 Mar 1 06:58:32 TWR5_SVR_RM_9300_1 %AUTHPRIV-3-SYSTEM_MSG: Unable to create
temporary user testuser. Error 0x404a000a usermod: group 'testuser' does not exist
(100663296) - login[820]
2016 Mar 1 06:58:32 TWR5_SVR_RM_9300_1 %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authenti
cation failed for user testuser from 172.16.74.23 - login[820]
2016 Mar 1 07:08:27 TWR5_SVR_RM_9300_1 %AUTHPRIV-3-SYSTEM_MSG: Unable to create
temporary user testuser. Error 0x404a000a usermod: group 'testuser' does not exist
(100663296) - login[1128]
2016 Mar 1 07:08:27 TWR5_SVR_RM_9300_1 %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authenti
cation failed for user testuser from 172.16.74.23 - login[1128]
2016 Mar 1 07:08:36 TWR5_SVR_RM_9300_1 %AUTHPRIV-3-SYSTEM_MSG: pam_aaa:Authenti
cation failed for user exit from 172.16.74.23 - login[1128]
2016 Mar 1 07:08:41 TWR5_SVR_RM_9300_1 %AUTHPRIV-2-SYSTEM_MSG: pam_unix(login:s
ession): close_session - error recovering username - login[1128]

it was cleared by rebooting the switch and i managed to login successfully using network-admin role now. Before, It tried to add same username locally but it rejected because it was created by remote auth. "no username <user>" also didn't clear the user-account.

There should be a way to clear it out or set a timeout value. Anyone facing the same issue in n9k?

just for anyone who is having

eddychristian10 — Tue, 15 Mar 2016 04:23:44 GMT

just for anyone who is having the same problem. It's caused by a bug.

https://supportforums.cisco.com/discussion/12763251/how-could-remove-cache-user-account-nexus-9k

Re: Below the output:

David Carrasco — Tue, 21 May 2019 20:36:01 GMT

YES. Yes I'm facing the same issue now and rebooting the switch fixed it for me. I tried this out in my lab switches to verify that reloading fixes the issue. But I can't possibly do this to hundreds of production switches. So...I may have to open a TAC case for this.