topic Re: Two questions about Tacacs: Local Password handling and log anonymization in Network Access Control

Two questions about Tacacs: Local Password handling and log anonymization

rmueller@cisco.com — Mon, 29 Jan 2018 10:35:28 GMT

Hi all,

my customer is looking to deploy ISE for device administration and got two questions:

1) They want to use the local database as an idendity store. Now the question came up about password handling for local users. The question here is if ISE has some kind of self-service portal where the local user could change/manage her/his password. I am not aware about such a portal. The only posbillity I am aware of is the usage of tacacs+ password change to do that or to use the mydevices-portal to build workaround. Am I correct?

2) Customer is asking if it is possible to anonymize TACACS accounting to hide which user actually did made a change?

Thanks in advance.

Roland

Re: Two questions about Tacacs: Local Password handling and log anonymization

vrostowsky — Mon, 29 Jan 2018 15:18:49 GMT

Rolland-

as for your questions, there is no "portal" to change passwords, but int ISE 2.x there are settings to allow pw changes via CLI. You will find them under the "Device Administration" workcenter (TACACS) then go to settings.

The changes made by each account, can only be abused if users share their passwords. as for the changes, these are the aaa accounting that records every change

aaa accounting exec ISE-LOCAL start-stop group TACACS

aaa accounting commands 0 ISE-LOCAL start-stop group TACACS

aaa accounting commands 15 ISE-LOCAL start-stop group TACACS

these will capture the whole session as well as the changes. I use a syslog server to collect all these events, bu tyou can also see them in the log buffer.

HTH-

Vince

Re: Two questions about Tacacs: Local Password handling and log anonymization

Jason Kunst — Mon, 29 Jan 2018 15:31:46 GMT

You can use my device or sponsor portal for password change portal

https://communities.cisco.com/thread/73087?start=0&tstart=0&mobileredirect=true

Re: Two questions about Tacacs: Local Password handling and log anonymization

Jason Kunst — Mon, 29 Jan 2018 15:41:49 GMT

Best to ask separate questions so we can manage them and mark accordingly

I don’t think you can anonymize tacacs It defeats the purpose of tracking who and what is done on a new device can you please explain the use case