Renuka Manavalan
6c1a0ce58c
[hostcfgd] -- Fix the default for failthrough as false.
...
This implies that by default, if TACACS is configured properly and it reported auth_err, then don't try fail through to traditional unix authentication through /etc/passwd.
If this failthrough is intended, make it explicit through "sudo config aaa authentication failthrough enable"
Removed an unused variable "aaa.fallback"
Tested manually. Note the presence of 'auth_err=die' in all cases except when failthrough is explicitly enabled.
admin@str-s6000-acs-13:~$ sudo config aaa authentication failthrough default; date
Wed Apr 3 23:05:18 UTC 2019
admin@str-s6000-acs-13:~$ ls -lrt /etc/pam.d/common-auth-sonic ; grep 123 /etc/pam.d/common-auth-sonic
-rw-r--r-- 1 root root 1316 Apr 3 23:05 /etc/pam.d/common-auth-sonic
auth [success=done new_authtok_reqd=done default=ignore auth_err=die] pam_tacplus.so server=100.127.20.22:49 secret=testing123 login=login timeout=5 try_first_pass
auth [success=done new_authtok_reqd=done default=ignore auth_err=die] pam_tacplus.so server=100.127.20.21:49 secret=testing123 login=login timeout=5 try_first_pass
admin@str-s6000-acs-13:~$ sudo config aaa authentication failthrough enable; date ; h4 "AAA|authentication"
Wed Apr 3 23:06:37 UTC 2019
admin@str-s6000-acs-13:~$ ls -lrt /etc/pam.d/common-auth-sonic ; grep 123 /etc/pam.d/common-auth-sonic
-rw-r--r-- 1 root root 1294 Apr 3 23:06 /etc/pam.d/common-auth-sonic
auth [success=done new_authtok_reqd=done default=ignore] pam_tacplus.so server=100.127.20.22:49 secret=testing123 login=login timeout=5 try_first_pass
auth [success=done new_authtok_reqd=done default=ignore] pam_tacplus.so server=100.127.20.21:49 secret=testing123 login=login timeout=5 try_first_pass
admin@str-s6000-acs-13:~$ sudo config aaa authentication failthrough disable; date ; h4 "AAA|authentication"
Wed Apr 3 23:07:09 UTC 2019
admin@str-s6000-acs-13:~$ ls -lrt /etc/pam.d/common-auth-sonic ; grep 123 /etc/pam.d/common-auth-sonic
-rw-r--r-- 1 root root 1321 Apr 3 23:07 /etc/pam.d/common-auth-sonic
auth [success=done new_authtok_reqd=done default=ignore auth_err=die] pam_tacplus.so server=100.127.20.22:49 secret=testing123 login=login timeout=5 try_first_pass
auth [success=done new_authtok_reqd=done default=ignore auth_err=die] pam_tacplus.so server=100.127.20.21:49 secret=testing123 login=login timeout=5 try_first_pass
2019-04-08 23:41:51 +00:00
Renuka Manavalan
def2780f18
[hostcfgd]: Promote logs for update-notifications-from-DB from DEBUG to INFO ( #2576 )
...
* Add a log message for each notification of add/del TACACS server.
Signed-off-by: Renuka Manavalan <remanava@microsoft.com>
* Moved another syslog message from DEBUG to INFO to be able to see those notifications.
All these changes are to help with a one-time-seen-bug, that hostcfgd did not act upon changes to redis for TACACS servers. We could not repro the bug.
Signed-off-by: Renuka Manavalan <remanava@microsoft.com>
2019-02-21 18:14:04 +00:00
kannankvs
a9a7ce1091
tacacs management vrf changes ( #2217 )
2018-12-04 10:22:48 -08:00
Taoyu Li
2a24a303ec
[tacplus nss conf] tacplus should be before compat ( #2163 )
2018-10-18 12:42:24 -07:00
Taoyu Li
208ca43760
[hostcfgd] Fix a bug that tacacs key is wrongly modified ( #1536 )
2018-03-28 10:55:59 -07:00
Taoyu Li
e84e093dea
Move all minigraph-related action from rc.local to updategraph ( #1452 )
...
- Move all minigraph-related action from rc.local to updategraph
- updategraph service is now after database. All feature services are now after and depending on updategraph
2018-03-09 17:17:08 -08:00
Taoyu Li
09f2385a15
[hostcfgd/tacacs] obfuscate tacacs credentials in syslog ( #1444 )
2018-03-02 21:24:01 -08:00
Liuqu
dce6d3536b
[TACACS+]: Add configDB enforcer for TACACS+ ( #1214 )
...
* [TACACS+]: Add configDB enforcer for TACACS+
* hostcfgd - configDB enforcer for TACACS+, listen configDB to
modify the pam configuration for Authentication in host
* Add a service script for hostcfgd
Signed-off-by: Chenchen Qi <chenchen.qcc@alibaba-inc.com>
* [TACACS+]: Generate conf file by template file
* Generate common-auth-sonic and tacplus_nss.conf by jinja2 template
Signed-off-by: Chenchen Qi <chenchen.qcc@alibaba-inc.com>
2017-12-12 03:45:44 -08:00
