I'm trying to implement tacacs authentication on a freebsd box as a client. The box is actually a network appliance that SHOULD have this config built into its cli/ui but doesn't. Since it's built on freebsd, it has the pam_tacplus.so library built in.

My problem is that I wish to authenticate to our tacacs server, but I don't wish to configure local accounts on the appliance. Here's the pam.conf file:

su      auth        sufficient  pam_rootok.so
su      auth        sufficient  pam_unix.so

login   auth            required        pam_unix.so
login   account         required        pam_unix.so
login   password        required        pam_permit.so
login   session         required        pam_permit.so

ftpd    auth            required        pam_unix.so

sshd    auth            sufficient      pam_tacplus.so  template_user=testuser      
sshd    auth            required        pam_unix.so
sshd    account         required        pam_unix.so
sshd    password        required        pam_permit.so
sshd    session         required        pam_permit.so

telnetd auth            required        pam_unix.so

passwd  password        required        pam_unix.so     no_warn try_first_pass nullok

other   auth            required        pam_unix.so

The tacacs server's ip address is stored in /etc/tacplus.conf and since I see failures in the tacacs server's log, I believe communication is successful. Additionally, I can establish TCP session to server on port 49.

When I try to log in via ssh as jimbob, here's what I see in the /var/log/auth.log:

<auth.info> Lab-2 sshd[4952]: Invalid user jimbob from
<auth.info> Lab-2 sshd[4952]: input_userauth_request: invalid user jimbob
<auth.info> Lab-2 sshd[4952]: Failed none for invalid user jimbob from port 52069 ssh2
<auth.info> Lab-2 sshd[4952]: Failed publickey for invalid user jimbob from port 52069 ssh2
<auth.info> Lab-2 sshd[4952]: Postponed keyboard-interactive for invalid user jimbob from port 52069 ssh2
<auth.info> Lab-2 sshd[4952]: Postponed keyboard-interactive/pam for invalid user jimbob from port 52069 ssh2
<auth.err> Lab-2 sshd[4953]: error: ssh_msg_send: write

After searching around, this seems to apply. This, however, talks about NSS, which is controlled by nsswitch.conf, which doesn't exist on this system. There doesn't appear to be a tacacs plugin for NSS; I'm not sure that it would matter, in my case, if there were.

So, is there a way to skip checking the local passwd file for a user before getting to the pam_tacplus.so library? I'm guessing that if there were, the template_user= option would kick in and try to use 'testuser,' which DOES exist as a localuser:

pw user show testuser
testuser:*:1003:1003::0:0:User &:/home/testuser:/usr/bin/bash

You can achieve this easily, as I have. You are right, you should use the nsswitch.conf file. However you will have to install a third party program , libnss-ato, which stands for All-To-One. It will validate non-local users against a a configured tacacs+ server, then behave exactly as you wished.

You can get that package and its details here: https://github.com/donapieppo/libnss-ato

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.