Linux Certif

Toute la documentation sur la certification Linux LPI

do_auth

NAME

do_auth - Program allowing more granular control than tac_plus.

SYNOPSIS

do_auth -u user [-i Ip Address] [-d Device address] [-f Config filename] [-l Log file] [-D Debug mode]

DESCRIPTION

do_auth is a python program written to work as an authorization script for tacacs to allow greater flexability in tacacs authentication. It allows a user to be part of many predefined groups that can allow different access to different devices based on ip, user, and source address.

Groups are assigned to users in the [users] section. A user must be assigned to one or more groups, one per line. Groups are defined in brackets, but can be any name. Each group can have up to 6 options as defined below.

 host_deny              Deny any user coming from this host.  Optional.

 host_allow             Allow users from this range. Mandatory with -i.

 device_deny            Deny any device with this IP.  Optional.

 device_permit          Allow this range. Mandatory if -d is specified.

 command_deny           Deny these commands.  Optional.

 command_permit Allow these commands.  Mandatory.

The options are parsed in order till a match is found. Obviously, for login, the commands section is not parsed. If a match is not found, or a deny is found, we move on to the next group. At the end, we have an implicit deny if no groups match. All tacacs keys passed on login to do_auth are returned. (except cmd*) It is possible to modify them, but I haven't implemented this yet as I don't need it. Future versions may have an av_pair & append_av_pair option.

OPTIONS

-u

Username. Mandatory. $user

-i

Ip address of user. Optional. If not specified, all host_ entries are ignored and can be omitted. $address

-d

Device address. Optional. If not specified, all device_ entries are ignored and can be omitted. $name

-f

Config Filename. Default is do_auth.ini.

-l

Logfile. Default is log.txt.

-D

Activate debug mode.

EXAMPLES

do_auth -i $address -u $user -d $name -l /var/log/do_auth.log -f /etc/tacacs+/do_auth.ini

EXIT STATUS

do_auth returns 0 to allow, 1 to deny authorization.

AUTHOR

Henry-Nicolas Tourneur from the do_auth file written by Dan Schmidt.

SEE ALSO

tac_plus(8), tac_plus.conf(5)