a357693f52
* Switch the nss look up order as "compat" followed by "tacplus". This helps use the legacy passwd file for user info and go to tacacs only if not found. This means, we never contact tacacs for local users like "admin". This isolates local users from any issues with tacacs servers. W/o this fix, the sudo commands by local users could take <count of servers> * <tacacs timeout> seconds, if the tacacs servers are unreachable. * Skip tacacs server access for local non-tacacs users. Revert the order of 'compat tacplus' to original 'tacplus compat' as tacplus access is required for all tacacs users, who also get created locally.
26 lines
889 B
Django/Jinja
26 lines
889 B
Django/Jinja
# Configuration for libnss-tacplus
|
|
|
|
# debug - If you want to open debug log, set it on
|
|
# Default: off
|
|
# debug=on
|
|
{% if debug %}
|
|
debug=on
|
|
{% endif %}
|
|
|
|
# server - set ip address, tcp port, secret string and timeout for TACACS+ servers
|
|
# Default: None (no TACACS+ server)
|
|
# server=1.1.1.1:49,secret=test,timeout=3
|
|
{% for server in servers %}
|
|
server={{ server.ip }}:{{ server.tcp_port }},secret={{ server.passkey }},timeout={{ server.timeout }}{% if server.vrf %},vrf={{ server.vrf }}{% endif %}{{''}}
|
|
{% endfor %}
|
|
|
|
# user_priv - set the map between TACACS+ user privilege and local user's passwd
|
|
# Default:
|
|
# user_priv=15;pw_info=remote_user_su;gid=1000;group=sudo,docker;shell=/bin/bash
|
|
# user_priv=1;pw_info=remote_user;gid=999;group=docker;shell=/bin/bash
|
|
|
|
# many_to_one - create one local user for many TACACS+ users which has the same privilege
|
|
# Default: many_to_one=n
|
|
# many_to_one=y
|
|
|