NAME
do_auth - Program allowing more granular control than tac_plus.
SYNOPSIS
do_auth -u user [-i Ip Address] [-d Device address] [-f Config
filename] [-l Log file] [-D Debug mode]
DESCRIPTION
do_auth is a python program written to work as an authorization script
for tacacs to allow greater flexability in tacacs authentication. It
allows a user to be part of many predefined groups that can allow
different access to different devices based on ip, user, and source
address.
Groups are assigned to users in the [users] section. A user must be
assigned to one or more groups, one per line. Groups are defined in
brackets, but can be any name. Each group can have up to 6 options as
defined below.
host_deny Deny any user coming from this host. Optional.
host_allow Allow users from this range. Mandatory with -i.
device_deny Deny any device with this IP. Optional.
device_permit Allow this range. Mandatory if -d is specified.
command_deny Deny these commands. Optional.
command_permit Allow these commands. Mandatory.
The options are parsed in order till a match is found. Obviously, for
login, the commands section is not parsed. If a match is not found, or
a deny is found, we move on to the next group. At the end, we have an
implicit deny if no groups match. All tacacs keys passed on login to
do_auth are returned. (except cmd*) It is possible to modify them,
but I haven’t implemented this yet as I don’t need it. Future versions
may have an av_pair & append_av_pair option.
OPTIONS
-u Username. Mandatory. $user
-i Ip address of user. Optional. If not specified, all host_
entries are ignored and can be omitted. $address
-d Device address. Optional. If not specified, all device_
entries are ignored and can be omitted. $name
-f Config Filename. Default is do_auth.ini.
-l Logfile. Default is log.txt.
-D Activate debug mode.
EXAMPLES
do_auth -i $address -u $user -d $name -l /var/log/do_auth.log -f
/etc/tacacs+/do_auth.ini
EXIT STATUS
do_auth returns 0 to allow, 1 to deny authorization.
AUTHOR
Henry-Nicolas Tourneur from the do_auth file written by Dan Schmidt.
SEE ALSO
tac_plus(8), tac_plus.conf(5)