0

I have migrated my Redhat Enterprise linux server 5.5 to IPv6 . Now I want to run tacacs+ for IPv6. When testing from my client, it returns "unable to connect to server for IPv6 address", but for IPv4 it’s working fine.

Snapshot of Linux listening port:

[root@ADA-Linux-Service-2 ~]# netstat -an | grep :49
tcp        0      0 0.0.0.0:49                  0.0.0.0:*                   LISTEN

Once the tacacs service is started, I tried using the bind option with IPv6 it returns the following error:

Reading config
Version F4.0.4.26 Initialized 1
get_socket: bind 49 Address already in use

I don’t know how to make tacacs+ listen on the IPv6 address. Do I need to create entries in tac_plus.cfg to listen for IPv6?

1 Answer 1

1

I came across this linuxquestions thread that discusses how to setup TACACS+ for IPv6, titled: How to get TACACS+ working for IPv6 interface. Specifically you need to add this to your tac_plus.cfg file:

id = spawnd {
listen = {address=2001::aaa1 port = 49 }
spawn = {
instances min = 1
instances max = 10
}

The listen line includes the IPv6 IP address. You can confirm that it's working with this command:

$ netstat -l
...
tcp6 0 0 2001::aaa1%32175:tacacs [::]:* LISTEN

Full Example .cfg file

id = spawnd {
  listen = {address=2001::aaa1 port = 49 }
  spawn = {
    instances min = 1
    instances max = 10
  }
  background = no
}

id = tac_plus {
  debug = PACKET AUTHEN AUTHOR

  access log = /hone/tornado/tacacs+/access.log
  accounting log = /home/tornado/tacacs+/acct.log

  host = world {
    address = ::/0
    prompt = "Welcome\n"
    enable 15 = clear force10
    key = testing123
  }
  group = admin {
    default service = permit
    service = shell {
      default command = permit
      default attribute = permit
      set priv-lvl = 15
    }
  }
  user = admin {
    password = clear admin
    member = admin
    service = shell {
      default command = permit
      default attribute = permit
      set priv-lvl = 15
    }
  }
}
7
  • Hi , Thanks for reply. But My Tacacs is not pro-bono-publico. My tacacs version belongs to shrubbery. In that if i added above lines the daemon is not starting it stated that error in the line... So i don't know how to solve this issue.
    – Murali
    Jul 12, 2013 at 11:54
  • @Murali - please share your .cfg file on pastebin.com so we can take a look.
    – slm
    Jul 12, 2013 at 12:43
  • Hi, I have pasted the config pastebin.com/xcCrBeyM in this link kinldy look into that. Thanks
    – Murali
    Jul 15, 2013 at 12:46
  • @Murali - the config you posted doesn't include any listen stanzas. I don't see how it can bind to a IPv4 or IPv6 port without any listening definitions. Also you're comment about your "pro-bono-publico" and "shrubbery". I don't know what you're referring to with either of those comments.
    – slm
    Jul 17, 2013 at 1:23
  • Ok Thanks, But when i added the above listen statements in my config and i restarted the tacacs daemon it throws the following error:tarting tacacs+: Error: Unrecognised token id on line 12
    – Murali
    Jul 17, 2013 at 8:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .