Radius vs TACACS - CLI Authorization

  • 0
  • 1
  • Question
  • Updated 2 years ago
  • Answered
I'm looking to setup authorization based on CLI command with either TACACS or RADIUS.
Apparently RADIUS seems to be a no-go according to this post: https://community.extremenetworks.com/extreme/topics/configuring-command-authorization-using-windows...

TACACS on the other hand has the option in XOS
#enable tacacs-authorization
Can someone confirm this is currently only possible with TACACS and explain why such support is missing from RADIUS with XOS 15.1 onwards?
Afterall, TACACS is Cisco while RADIUS should be open and the preferred way.
Photo of vobelic

vobelic

  • 362 Points 250 badge 2x thumb

Posted 3 years ago

  • 0
  • 1
Photo of Ronald Dvorak

Ronald Dvorak, Embassador

  • 49,992 Points 20k badge 2x thumb
https://en.wikipedia.org/wiki/TACACS

https://community.extremenetworks.com/extreme/topics/configuring-command-authorization-using-windows...

From the above post...
"These VSA's were used and supporting in older firmware (with limited commands) in FreeRadius server & Merit Radius servers. 

As this was supported with limited commands and only with few Radius servers, we have removed this from EXOS 15.1.3.1 onwards."


-Ron
Photo of vobelic

vobelic

  • 362 Points 250 badge 2x thumb
Yes, thank you for quoting what I already know about RADIUS.

What about TACACS, does CLI authorization actually work?
Photo of Grosjean, Stephane

Grosjean, Stephane, Employee

  • 13,566 Points 10k badge 2x thumb
Hi,

yes, you can deny some commands with TACACS+ on EXOS.
It was possible with Radius using the old VSA and some tweaking. Apparently, the VSA has been removed.
Photo of Kunlin Lu

Kunlin Lu

  • 72 Points
How to deny some commands with TACACS+ on EXOS ?
How to assign admin right to account with TACACS+ ?
Photo of Drew C.

Drew C., Community Manager

  • 40,206 Points 20k badge 2x thumb
What TACACS+ server are you using?

If it helps, one of the labs I built some time back used a variation of Cisco's TACACS+ server.  The user config looked like this:
# Configure User
user = drew {
login = cleartext "mypassword"
service = exec {
priv-lvl = 15
}
cmd = show {
permit .*
}
cmd = download {
permit .*
}
}
user = admin {
default service = permit
login = cleartext ""
}
This gave "drew" an admin level account that could only run show and download commands, and denied everything else.  You can also explicitly deny certain commands.  The admin account was configured as it normally is on the switch by default.
(Edited)
Photo of Kunlin Lu

Kunlin Lu

  • 72 Points
Hi Drew

It is work, thanks a lot.

I have one more question
If priv-lvl is not 15 and the user need to exec "show configuration"
How to ?
Photo of Drew C.

Drew C., Community Manager

  • 40,206 Points 20k badge 2x thumb
Hi Kunlin,
I don't recall how EXOS will handle that since that command requires an admin-level account.  If you're able to do some testing, I'd be curious to see what you find out.
Photo of Daniel Flouret

Daniel Flouret, Employee

  • 7,470 Points 5k badge 2x thumb
EXOS per-command authorization works OK if you're willing to use and modify FreeRADIUS.

I did some investigations on a personal basis some time ago. This is very informally documented in this file:
https://www.dropbox.com/s/m4ukvkrl3wyt2qq/EXOS%20Per-Command%20Authentication.docx?dl=0

The document mentions several files that have to be installed in FreeRADIUS and that can be found here:
https://www.dropbox.com/s/e944v2o73404f57/EXOS_PCA_files.zip?dl=0

Be warned, this will work but with no guarantee. Also, Extreme Networks is not involved in any way in this development.

Haven't played with it in a long time, so no guarantees it will work with the latest FreeRADIUS releases.

Feel free to experiment.
(Edited)