Tacacs+ and Groups

[Saeed42]

We have Routers dotted around the country and we use Tacacs+ for authentication, now what we need to do is to allow local admins to have access to their local router only, and this is where I'm running into few problems.

Tacacs+ uses the default Linux "passwd" file and anyone with an active account on these two servers can access the routers, switches and firewalls. how would you go about so that some users can access certain devices while others can access everything, do I need to use Authorization instead of authentication


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Don't be content with being average. Average is as close to the bottom as it is to the top
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[Frenchie2069]

You should be able to put the users into groups and restrict the list of allowed NAS for each group.

This works on the Windows version, I have never used the linux version

HTH,
Michael.

 

[Saeed42]

We already have groups, and users are members of groups which determines what commands they can run, but I'm not sure how to stop certain groups from logging into certain routers without access-list


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Don't be content with being average. Average is as close to the bottom as it is to the top
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[Frenchie2069]

In the group configuration can you see a list of allowed NAS?

I think that on the windows version (2.6) that I used to use you were able to restrict the groups to a list of valid NAS (Network Access Servers). Each router needs to be configured as a NAS for CiscoSecure to authenticate logins, so you should be able to restrict groups to specific routers. (I think this is how it worked, I am a little rusty on it).

I am hoping to have a new installation of ACS in my current position very soon. Might be able to give more help then. Not sure how different the unix implementation of ACS is either...

HTH,
Michael.

 

[Saeed42]

The only thing each group seems to have is list of what commands they can execute and group password. Do you remember what commands you had in your tacacs+ config file? I'm pretty sure the Linux and the Windows version are probably similar and seeing that config file would probably point me to the right direction.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Don't be content with being average. Average is as close to the bottom as it is to the top
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~