01-05-2017 02:36 AM
Hello there,
Is there anyone who can enable command authorization with tacacs+ server in Small Business Switch SG500 with the latest OS (1.4.7.5) ?
The TACACS+ server is running fine with authentication/authorization for Catalyst 3850.
But the this server work only for authentication... not authorization for Small Business Switch.
If I run the TACACS+ server with debug option, then Small Business Server never send authorization command to the TACACS+ server.
root@jpmonitor01# /usr/local/sbin/tac_plus -C /usr/local/etc/tac_plus.conf -g -d 32768
Reading config
Version F4.0.4.28 Initialized 1
tac_plus server F4.0.4.28 starting
socket FD 4 AF 28
socket FD 5 AF 2
uid=559 euid=559 gid=559 egid=559 s=677478864
connect from 10.100.255.70 [10.100.255.70]
Can't open acct file /var/log/tac_plus.acct -- Permission denied
connect from 10.100.255.70 [10.100.255.70]
login query for 'hmiyoshi' port unknown-port from 10.100.255.70 accepted
connect from 10.100.255.70 [10.100.255.70]
10.100.255.70: Cannot lock /var/log/tac_plus.acct
connect from 10.100.255.70 [10.100.255.70]
10.100.255.70: Cannot lock /var/log/tac_plus.acct
connect from 10.100.255.66 [10.100.255.66]
login query for 'hmiyoshi' port tty2 from 10.100.255.66 accepted
connect from 10.100.255.66 [10.100.255.66]
authorization query for 'hmiyoshi' tty2 from 10.100.255.66 accepted
connect from 10.100.255.66 [10.100.255.66]
authorization query for 'hmiyoshi' tty2 from 10.100.255.66 rejected
connect from 10.100.255.66 [10.100.255.66]
authorization query for 'hmiyoshi' tty2 from 10.100.255.66 accepted
connect from 10.100.255.70 [10.100.255.70]
10.100.255.70: Cannot lock /var/log/tac_plus.acct
The IP address 10.100.255.70 is Small Business Switch and 10.100.255.66 is Catalyst 3850.
The aaa command in SG500 is like this.
aaa authentication login authorization SSH tacacs local
aaa authentication enable authorization SSH tacacs enable
Of course I logon to this switch with SSH ..
Any information will be highly appreciated.
Miyoshi
04-09-2019 01:26 AM
Hi,
I´m facing this question in general too, using 2.4.5.71
the Administration Guide stats:
Authorization—Performed at login. After the authentication session is completed, an
authorization session starts using the authenticated username. The TACACS+ server
then checks user privileges.
is it "only" possible to refer the users to the default Priviledge Levels of 1, 7 and 15 or is it possible to build a customized Command-Set using a e.g. Authoriziation-List like the Enterprise devices support?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide