Can you help me?

Thanks in advance

So, let’s debug with -D. (don’t run from command line without -D)

python do_auth.py -i 10.1.1.1 -u alex -d 192.168.1.1 -l log.txt -f do_auth.ini -D

We get errors:

Traceback (most recent call last):
File “do_auth.py”, line 375, in
main()
File “do_auth.py”, line 281, in main
if not (filename in config.read(filename)):
File “/usr/lib/python2.6/ConfigParser.py”, line 286, in read
self._read(fp, filename)
File “/usr/lib/python2.6/ConfigParser.py”, line 510, in _read
raise e
ConfigParser.ParsingError: File contains parsing errors: do_auth.ini
[line 3]: ‘admin\n’
….

I see the problem. No tabs! I can’t seem to print tabs on the wiki, but you need tabs everywhere I have a \t

[users]
alex =
\tadmin

[admin]
host_allow =
\t.*
device_permit =
\t.*
command_permit =
\t.*

After than, it’s a lot happier:
dan@dan-desktop:~$ python do_auth.py -i 10.1.1.1 -u alex -d 192.168.1.1 -l log.txt -f do_auth.ini -D
dan@dan-desktop:~$ cat log.txt
2010-03-25 18:16:06: User ‘alex’ allowed command ’show users wide’ to device ‘192.168.1.1′ in ‘admin’->’command_permit’

The debug command is hard coded to “show users wide.” I was going to change that to allow a variable, but I was finished with the program and nobody else had any interest in it.

# This is my tacacs cfg
key = xxxxx
accounting file = /var/log/tac_acc.log
default authentication = file /etc/passwd
user = DEFAULT {
member = do_auth_access
}
group = do_auth_access {
default service = permit
service = exec {
priv-lvl = 15
}
enable = file /etc/passwd
after authorization “/usr/bin/python /etc/tacacs/do_auth.pyc -i $address -u $user -d $name -l /var/log/log.txt -f /etc/tacacs/do_auth.ini”
}

#log.txt is empty

I get the following

telnet 172.17.0.68
Trying 172.17.0.68…
Connected to 172.17.0.68.
Escape character is ‘^]’.

User Access Verification

Username: xxxx
Password:
% Authorization failed.
Connection closed by foreign host.

Skip – This code works by commands, not privilege levels. Not that it couldn’t be done, I just did not have a need at the time to modify the tac pairs. You could take priv-lvl = 15 out of the config and deny “enable” to the users you don’t want to enable. Or, put them in a different group in tac_plus.conf, but that means you now have to modify two configuration files instead of one.

The examples above were done in much haste, there might be errors; if other people are actually interested in this, I’ll try to fix it up a bit. My current employer doesn’t use tac_plus, so I don’t have a testing environment any more.