I'm trying to implement tacacs authentication on a freebsd box as a client. The box is actually a network appliance that SHOULD have this config built into its cli/ui but doesn't. Since it's built on freebsd, it has the pam_tacplus.so library built in.
My problem is that I wish to authenticate to our tacacs server, but I don't wish to configure local accounts on the appliance. Here's the pam.conf file:
su auth sufficient pam_rootok.so su auth sufficient pam_unix.so login auth required pam_unix.so login account required pam_unix.so login password required pam_permit.so login session required pam_permit.so ftpd auth required pam_unix.so sshd auth sufficient pam_tacplus.so template_user=testuser sshd auth required pam_unix.so sshd account required pam_unix.so sshd password required pam_permit.so sshd session required pam_permit.so telnetd auth required pam_unix.so passwd password required pam_unix.so no_warn try_first_pass nullok other auth required pam_unix.so
The tacacs server's ip address is stored in /etc/tacplus.conf and since I see failures in the tacacs server's log, I believe communication is successful. Additionally, I can establish TCP session to server on port 49.
When I try to log in via ssh as jimbob, here's what I see in the /var/log/auth.log:
<auth.info> Lab-2 sshd: Invalid user jimbob from 10.0.0.1 <auth.info> Lab-2 sshd: input_userauth_request: invalid user jimbob <auth.info> Lab-2 sshd: Failed none for invalid user jimbob from 10.0.0.1 port 52069 ssh2 <auth.info> Lab-2 sshd: Failed publickey for invalid user jimbob from 10.0.0.1 port 52069 ssh2 <auth.info> Lab-2 sshd: Postponed keyboard-interactive for invalid user jimbob from 10.0.0.1 port 52069 ssh2 <auth.info> Lab-2 sshd: Postponed keyboard-interactive/pam for invalid user jimbob from 10.0.0.1 port 52069 ssh2 <auth.err> Lab-2 sshd: error: ssh_msg_send: write
After searching around, this seems to apply. This, however, talks about NSS, which is controlled by nsswitch.conf, which doesn't exist on this system. There doesn't appear to be a tacacs plugin for NSS; I'm not sure that it would matter, in my case, if there were.
So, is there a way to skip checking the local passwd file for a user before getting to the pam_tacplus.so library? I'm guessing that if there were, the template_user= option would kick in and try to use 'testuser,' which DOES exist as a localuser:
pw user show testuser testuser:*:1003:1003::0:0:User &:/home/testuser:/usr/bin/bash