On Wed, 2011-06-08 at 19:36 +0200, Peter Rathlev wrote: > I tried fiddling with "before authorization" and "after authorization" > but couldn't get it to work the way I wanted to. The "after" method > seemed suitable until I realised that tac_plus never sends any AV pairs > to the called script when authorization has failed.
Oh, I now see that it's not supposed to. The problem is that "PASS_REPL" isn't supported for "service=shell" it seems. Depending on how well supported you want it to be, you could patch[0] do_author.c to accept a fourth return code from an "after authorization" script. This fourth code would make tac_plus send PASS_ADD (with nothing to add just like a regular pass) even when the default authorization failed. You would then configure the user or group in tac_plus.conf with after authorization "/usr/local/bin/some-script.sh $name $status" In this script[1] you could return 3 when $name is one of the devices where anything is permitted and the prelimiary status was "fail". Users and/or groups would be members of a group limiting them to what's allowed on every device. The script overrides any "fail", giving the users complete access to those devices. Example patch and script: [0]: http://ampere.rathlev.dk/tacacs+-F4.0.4.19-after-authorization-extra-rc.patch [1]: http://ampere.rathlev.dk/unconditional-permit-something.sh -- Peter _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
