topic Re: Tacacs+ docker container returns encrypted response in Network Access Control

Tacacs+ docker container returns encrypted response

ygorelik — Fri, 15 Jul 2022 17:31:28 GMT

I am trying to use Tacacs+ docker container with Mac as a docker host. It starts the container fine although I had to add -P option to map docker exposed port 49 to some local host port. The tac_plus server seems running fine:

$ ps -ef | grep tac
root 1 0 0 16:48 pts/0 00:00:00 /bin/sh -c service tacacs_plus restart && bash
root 29 1 0 16:48 pts/0 00:00:00 /usr/sbin/tac_plus -C /etc/tacacs+/tac_plus.conf
root 51 43 0 16:49 pts/1 00:00:00 grep tac

$ service tacacs_plus status
Checking status of TACACS+ authentication daemon tacacs+ [ OK ]

Unfortunately the Tacacs+ client from Python package tacacs-plus returns some encrypted values:

$ tacacs_client -v -H 127.0.0.1 -p 55005 -k testing123 -u tacadmin authenticate --password password
status: UNKNOWN: 215
server_msg: b’T\x17#\x0c\xed\x8d[#jE\xc2\xdb4\xeev\xcb\xfa\x95&\x96\xf6\xed\xf4[\x9aOP\x0c\xb8[\xd6D\xc2\xc2\x01\x08h\xea!\xda\xf8\xfe\xd9V;$c\xcd\x15z\xac\x1f\x0e’
flags: 166

And the tac_plus server does not create any logs, which makes it difficult to understand, what is going wrong. Do you have any suggestions, how I can overcome these issues?

Yan

Re: Tacacs+ docker container returns encrypted response

ahollifield — Fri, 15 Jul 2022 17:43:07 GMT

Does this have anything to do with any Cisco products? Identity Services Engine?

Re: Tacacs+ docker container returns encrypted response

ygorelik — Fri, 15 Jul 2022 19:05:21 GMT

As I know, the Tacacs is Cisco developed product and ISE based on it.

Re: Tacacs+ docker container returns encrypted response

hslai — Sun, 17 Jul 2022 00:40:38 GMT

Although ISE provides T+ protocol, it is definitely not the same as the one you tried to run from the docker container, which has no clear info of sources and support.

If you would like to try ISE, please contact us directly.

Re: Tacacs+ docker container returns encrypted response

ygorelik — Mon, 18 Jul 2022 22:46:14 GMT

The kudos go to Luiz Lima, who developed the TACACS+ docker container, which I tried to use. The RC was typo in copy paste, which created mismatch between Tacacs configuration key and the key supplied in the command line. The configuration contained line "key = tacacs123" and CLI "-k testing 123". Once command line corrected I got expected result:

$ tacacs_client -v -H 127.0.0.1 -p 55005 -k tacacs123 -u tacadmin authenticate --password password
status: PASS

Yan