Tacacs + authentication for Redhat server as a client

[halima.naboulsi]

Hello,

Can someone help me, I have this error when I try to login on Redhat server :

TacacsLoginFlow,22/11/2010,18:41:58:347,ERROR,3057433504,cntx=0003764282,sesn=EMEA-PAR-ACS01/78155693/561084,user=user-name,Failed to dispatch the T+ Authen Login packet,TacacsLoginFlow.cpp:74

I can't find the file TacacsLoginFlow.cpp, I think that is a source file.

I need your help !!

[Nicolas Darchis]

Hi,

Can you clarify what is the relation with cisco devices ?

Thanks.

Nicolas

[halima.naboulsi]

Hello,

I have a Cisco Secure ACS, I configured Tacacs+ on it. It works fine with network device, but now I'm testing to configure authentication for servers.

I installed a rpm for that on client server.

When I tried to authenticate via Tacacs+ server I had the error above.

could you please help me to resolv it?

Regards,

[Nicolas Darchis]

Well it's a client-side red hat issue ... I'm not sure the ACS has anything to do with it in the first place.

Can you be more specific on the tacacs rpm you installed ?

Nicolas

[halima.naboulsi]

Hello,

I installed this rpm which I compiled "pam_tacplus-1.3.2-1.x86_64.rpm", and I configured these two files:

/etc/pam.d/tacacs:

#%PAM-1.0
auth      sufficient    /lib/security/pam_tacplus.so debug server=server_IP timeout=5 secret=Key_secret encrypt
account   sufficient    /lib/security/pam_tacplus.so debug server=server_IP timeout=5 secret=Key_secret encrypt service=shell protocol=ssh
session   sufficient    /lib/security/pam_tacplus.so debug server=server_IP timeout=5 secret=Key_secret encrypt service=shell protocol=ssh

/etc/pam.d/sshd:

#%PAM-1.0
auth               include          tacacs

account          include          tacacs
password        required         tacacs
session          include          tacacs

Thanks and Regards,

[halima.naboulsi]

Hello,

I had this erreor on ACS side:

Response = {Type=Authentication; Authen-Reply-Status=Error; }

Juste to clarify, It uses PAM.

Thanks and Regards,

[Nicolas Darchis]

That RPM was not made by Cisco afaik so I'm not sure if anyone here can help you.

What's your ACS version btw ? That output would look like ACS for Unix ??

Nicolas