TACACS+, $enable$ and $enab15$

[annayuzhao]

Hi all

We setup TACACS+ authentication by

following this link

http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a00800946a3.shtml .

We noticed there are some authentication failures among couple hundred success. From the TACACS+ log file it indicateds for these failed logon it uses $enab15$ and not $enable$ to do authentication. But we only configured $enable$ on the TACACS+ based on the above Cisco link.

I have the following questions about this issue:

1. What's the difference between $enab15$ and $enable$?

2. Under which circumstance the server will use $enab15$ instead of $enable$ when the server actually is only configured with $enable$.

Thanks very much

[owillins]

Whenever you attempt to enable, an authentication request is sent with the special username $enab$ where is the privilege level you are attempting to enable to. In order to be compatible with earlier versions of tacacs, when the requested enable level is 15, the daemon will also try the username $enable$ before trying username $enab15$.