On Wed, 2011-06-08 at 11:45 +0000, Brian Raaen wrote: > > You can use ACLs in tac_plus.conf, though I'm not certain exactly what > > you want to achieve. Here's an example configuration to peruse: > > > > http://ampere.rathlev.dk/tac_plus-example.conf > > Thanks the helps clear things a little bit. The only issue I have is > the lower level engineers need full access to most customer equipment, > just limited access to a few exception customers. > If there is a way a person can be a member of two groups at the same > time then I could use your example to ACL the Special set of devices.
AFAIK not with the Shrubbery version that we use. From the docs it seems that Marc Huber's tac_plus (http://www.pro-bono-publico.de/projects/) has some kind of dynamic membership capability, but I'm not familiar with it. I tried fiddling with "before authorization" and "after authorization" but couldn't get it to work the way I wanted to. The "after" method seemed suitable until I realised that tac_plus never sends any AV pairs to the called script when authorization has failed. That does seem somewhat logical, but it means that the script has to construct all the AV pairs by itself. And there's no way of knowing what the command was. I'll test it a bit more to see if there's a way around this. It's an interesting exercise. :-) -- Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
