0

I have migrated my Redhat Enterprise linux server 5.5 to IPv6 . Now I want to run tacacs+ for IPv6. When testing from my client, it returns "unable to connect to server for IPv6 address", but for IPv4 it’s working fine.

Snapshot of Linux listening port:

[root@ADA-Linux-Service-2 ~]# netstat -an | grep :49
tcp        0      0 0.0.0.0:49                  0.0.0.0:*                   LISTEN

Once the tacacs service is started, I tried using the bind option with IPv6 it returns the following error:

Reading config
Version F4.0.4.26 Initialized 1
get_socket: bind 49 Address already in use

I don’t know how to make tacacs+ listen on the IPv6 address. Do I need to create entries in tac_plus.cfg to listen for IPv6?

1

I came across this linuxquestions thread that discusses how to setup TACACS+ for IPv6, titled: How to get TACACS+ working for IPv6 interface. Specifically you need to add this to your tac_plus.cfg file:

id = spawnd {
listen = {address=2001::aaa1 port = 49 }
spawn = {
instances min = 1
instances max = 10
}

The listen line includes the IPv6 IP address. You can confirm that it's working with this command:

$ netstat -l
...
tcp6 0 0 2001::aaa1%32175:tacacs [::]:* LISTEN

Full Example .cfg file

id = spawnd {
  listen = {address=2001::aaa1 port = 49 }
  spawn = {
    instances min = 1
    instances max = 10
  }
  background = no
}

id = tac_plus {
  debug = PACKET AUTHEN AUTHOR

  access log = /hone/tornado/tacacs+/access.log
  accounting log = /home/tornado/tacacs+/acct.log

  host = world {
    address = ::/0
    prompt = "Welcome\n"
    enable 15 = clear force10
    key = testing123
  }
  group = admin {
    default service = permit
    service = shell {
      default command = permit
      default attribute = permit
      set priv-lvl = 15
    }
  }
  user = admin {
    password = clear admin
    member = admin
    service = shell {
      default command = permit
      default attribute = permit
      set priv-lvl = 15
    }
  }
}
  • Hi , Thanks for reply. But My Tacacs is not pro-bono-publico. My tacacs version belongs to shrubbery. In that if i added above lines the daemon is not starting it stated that error in the line... So i don't know how to solve this issue. – Murali Jul 12 '13 at 11:54
  • @Murali - please share your .cfg file on pastebin.com so we can take a look. – slm Jul 12 '13 at 12:43
  • Hi, I have pasted the config pastebin.com/xcCrBeyM in this link kinldy look into that. Thanks – Murali Jul 15 '13 at 12:46
  • @Murali - the config you posted doesn't include any listen stanzas. I don't see how it can bind to a IPv4 or IPv6 port without any listening definitions. Also you're comment about your "pro-bono-publico" and "shrubbery". I don't know what you're referring to with either of those comments. – slm Jul 17 '13 at 1:23
  • Ok Thanks, But when i added the above listen statements in my config and i restarted the tacacs daemon it throws the following error:tarting tacacs+: Error: Unrecognised token id on line 12 – Murali Jul 17 '13 at 8:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.