TACACS+

Terminal Access Controller Access Control System の略省
　　詳細は TACACS を参照

本来であれば、CiscoSystems のネットワーク機器認証は Cisco Secure Access Control System（以下、ACS）を利用

ACS は高額なため、費用面からオープンソースの TACACS+ を利用

Linux 上に構築

オープンソースを利用し、ソースからコンパイルを行い構築

構築される環境に応じて、適宜読み替えてください。

Shrubbery Networks - TACACS+ daemon にアクセス

Download it from ftp://ftp.shrubbery.net/pub/tac_plus をクリック

tacacs-F4.0.4.28.tar.gz をダウンロード

ダウンロードした tacacs-F4.0.4.28.tar.gz を構築するサーバーへ FTP や SCP などで格納

構築するサーバーへログインし root になる

cd /hogehoge
tar zxvf tacacs-F4.0.4.28.tar.gz
./configure –enable-acls –enable-uenable
make
make install

上記、操作中にエラーがないこと

cd /etc/init.d
vi tacacsd

#!/bin/bash
#####!#/bin/sh
#
# tacacsd       This shell script takes care of starting and stopping
#               tac_plus
#
# chkconfig: 2345 85 15
# description: tacacsd

# Source function library.
. /etc/rc.d/init.d/functions
#####.# /etc/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ ${NETWORKING} = "no" ] && exit 0

# Some parameters.
# program file
PRG=/usr/local/sbin/tac_plus
# Process id file
PID=/var/run/tac_plus.pid
# config file
CNF="/etc/tac_plus.conf"
# log file
LOG=/var/log/tac_plus.log
# lock file
LOK=/var/lock/subsys/tacacsd
# debug option
DBG=0

# Check that tac_plus.
[ -f $PRG ] || exit 0

[ -f $CNF ] || exit 0

# See how we were called.
case "$1" in
    start)
        # Start daemon.
        if [ $DBG -gt 0 ]
        then
            echo -n "Starting TACACS with debug level $DBG: "
            daemon $PRG -C $CNF -d $DBG -l $LOG
        else
            echo -n "Starting TACACS: "
            daemon $PRG -C $CNF -l $LOG
        fi
        echo
        touch $LOK
        ;;

    stop)
        # Stop daemons.
        echo -n "Shutting down TACACS: "
        killproc tac_plus
        rm -f $LOK
        echo
        ;;

    status)
        status tac_plus
        exit $?
        ;;

    restart)
        $0 stop
        $0 start
        ;;

    reload)
        echo "TACACS now reloading......"
        kill -SIGUSR1 `cat $PID`
        exit $?
        ;;

    test)
        echo "TACACS config being testing..."
        $PRG -P -C $CNF
        ;;

    *)
        echo "Usage: $0 {start|stop|status|restart|reload|test}"
        exit 1
esac

exit 0

-rwxr-xr-x 1 root root 9999  x月 xx 99:99 tacacsd

chkconfig –add tacacsd
chkconfig –list tacacsd

tacacsd       0:off 1:off 2:on  3:on  4:on  5:on  6:off

上記、操作中にエラーがないこと

vi /etc/tac_plus.conf

##### set up accounting file if enabling accounting
accounting file = /var/log/tac_plus.acc

##### set the secret key
# key = <SecretKey>
key = hogekey

##### enable password setup for everyone
user = $enable$ {
    # login = cleartext <EnablePassword>
    login = cleartext enbpass
}

##### access control lists
acl = list_acl {
    # permit = <AAAClientIP>      # <NodeName>
    permit = 192.168.0.1        # HOGE1
    permit = 192.168.0.2        # HOGE2
}

##### group listings must be first
group = group_admin {
    default service = permit
    # Users in group 'group_admin' have cleartext password
    # login = cleartext <GroupPassword>
    login = cleartext admpass
}

##### User listings
user = hogeadmin {
    member = group_admin
    acl = list_acl

    cmd = web {
        permit capture
        permit system
        permit collection
        permit account
        permit alarm
        permit view
    }

    service = exec {
        # optional shell:<Context> = "<Role> <domain>"
        optional shell:Admin = "Admin default-domain"
    }
}

service tacacsd start

Starting TACACS: [  OK  ]

service tacacsd stop

Shutting down TACACS: [  OK  ]

service tacacsd restart

Shutting down TACACS: [  OK  ]
Starting TACACS: [  OK  ]