Tacacs
Telnet Privilege Map
Description
A TACACS+ server is added to a TACACS+ group which is added to an AAA list. This list is assigned to the login system’s authentication. Finally, the TACACS+ 0 and 15 privilege levels are mapped to locally defined roles. The device then starts a Telnet session with itself to check that it can only run the commands that role is authorized to run.
Scenario
Step 1: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 10.215.168.64/24 set system aaa server tacacs serv1 address 10.215.168.1 set system aaa server tacacs serv1 key 1234 set system aaa group tacacs tacgroup1 server serv1 set system aaa list list1 method 1 group tacacs tacgroup1 set system aaa authorization privilege-map tacacs 15 role monitor set system aaa authorization privilege-map tacacs 0 role admin set system login aaa authentication list1 set service telnet
Step 2: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.269 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.269/0.269/0.269/0.000 ms
Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :
admin@DUT0$ telnet 127.0.0.1Show output
Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. osdx login: Password: Welcome to Teldat OSDx 202312121141.f6f83ac-v3.9.1.1-snapshot This system includes free software. Contact Teldat for licenses information and source code. testing@osdx$
Step 4: Run command service cnm restart at DUT0 and expect this output:
Show output
service inactive. doing nothing.
Step 5: Run command show running at DUT0 and expect this output:
Show output
# Teldat OSDx VM version 202312121141.f6f83ac-v3.9.1.1-snapshot # Wed 13 Dec 2023 02:04:00 AM UTC # Warning: Configuration has not been saved set interfaces ethernet eth0 address 10.215.168.64/24 set service telnet set system aaa authorization privilege-map tacacs 0 role admin set system aaa authorization privilege-map tacacs 15 role monitor set system aaa group tacacs tacgroup1 server serv1 set system aaa list list1 method 1 group tacacs tacgroup1 set system aaa server tacacs serv1 address 10.215.168.1 set system aaa server tacacs serv1 encrypted-key U2FsdGVkX1/MSaU0GG7WOfZDMTqMyR4TVGtgrwzPnJk= set system login aaa authentication list1 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 6: Run command show date at DUT0 and expect this output:
Show output
Wed Dec 13 02:04:00 UTC 2023
Step 7: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :
admin@DUT0$ telnet 127.0.0.1Show output
Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. osdx login: Password: Welcome to Teldat OSDx 202312121141.f6f83ac-v3.9.1.1-snapshot This system includes free software. Contact Teldat for licenses information and source code. testadmin@osdx$
Step 8: Run command service cnm restart at DUT0 and expect this output:
Show output
CLI Error: Insufficient privileges
Step 9: Run command show running at DUT0 and expect this output:
Show output
CLI Error: Insufficient privileges
Step 10: Run command show date at DUT0 and expect this output:
Show output
Wed Dec 13 02:04:01 UTC 2023
SSH Privilege Map
Description
A TACACS+ server is added to a TACACS+ group which is added to an AAA list. This list is assigned to the SSH service’s authentication. Finally, the TACACS+ 0 and 15 privilege levels are mapped to locally defined roles. The device then starts an SSH session with itself to check that it can only run the commands that role is authorized to run.
Scenario
Step 1: Set the following configuration in DUT0:
set interfaces ethernet eth0 address 10.215.168.64/24 set system aaa server tacacs serv1 address 10.215.168.1 set system aaa server tacacs serv1 key 1234 set system aaa group tacacs tacgroup1 server serv1 set system aaa list list1 method 1 group tacacs tacgroup1 set system aaa authorization privilege-map tacacs 15 role monitor set system aaa authorization privilege-map tacacs 0 role admin set service ssh aaa authentication list1
Step 2: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.302 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.302/0.302/0.302/0.000 ms
Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testing:
admin@DUT0$ ssh testing@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/nullShow output
Warning: Permanently added '127.0.0.1' (ED25519) to the list of known hosts. testing@127.0.0.1's password: Welcome to Teldat OSDx 202312121141.f6f83ac-v3.9.1.1-snapshot This system includes free software. Contact Teldat for licenses information and source code. testing@osdx$
Step 4: Run command service cnm restart at DUT0 and expect this output:
Show output
service inactive. doing nothing.
Step 5: Run command show running at DUT0 and expect this output:
Show output
# Teldat OSDx VM version 202312121141.f6f83ac-v3.9.1.1-snapshot # Wed 13 Dec 2023 02:04:22 AM UTC # Warning: Configuration has not been saved set interfaces ethernet eth0 address 10.215.168.64/24 set service ssh aaa authentication list1 set system aaa authorization privilege-map tacacs 0 role admin set system aaa authorization privilege-map tacacs 15 role monitor set system aaa group tacacs tacgroup1 server serv1 set system aaa list list1 method 1 group tacacs tacgroup1 set system aaa server tacacs serv1 address 10.215.168.1 set system aaa server tacacs serv1 encrypted-key U2FsdGVkX1+NfpH/uwW3grW6ifRs1psMEteF3X7lmoY= set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 6: Run command show date at DUT0 and expect this output:
Show output
Wed Dec 13 02:04:22 UTC 2023
Step 7: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testadmin:
admin@DUT0$ ssh testadmin@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/nullShow output
Warning: Permanently added '127.0.0.1' (ED25519) to the list of known hosts. testadmin@127.0.0.1's password: Welcome to Teldat OSDx 202312121141.f6f83ac-v3.9.1.1-snapshot This system includes free software. Contact Teldat for licenses information and source code. testadmin@osdx$
Step 8: Run command service cnm restart at DUT0 and expect this output:
Show output
CLI Error: Insufficient privileges
Step 9: Run command show running at DUT0 and expect this output:
Show output
CLI Error: Insufficient privileges
Step 10: Run command show date at DUT0 and expect this output:
Show output
Wed Dec 13 02:04:23 UTC 2023