Tacacs

Telnet Default Authorization 

Description 

A TACACS+ server is added to a TACACS+ group which is added to an AAA list. This list is assigned to the login system’s authentication. In this scenario, the default authorization mapping is used, which maps the privilege level 0 to monitor, 5 to operator, and 15 to admin. The device then starts a Telnet session with itself to check that it can only run the commands that role is authorized to run.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set service telnet
set system aaa group tacacs tacgroup1 server serv1
set system aaa list list1 method 1 group tacacs tacgroup1
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX18YdBV4s5pk49+0HahPiuwCWRt3IKAyqtE=
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 4: Run command service cnm restart at DUT0 and expect this output:

Step 5: Run command show running at DUT0 and expect this output:

Step 6: Run command show date at DUT0 and expect this output:

Step 7: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 8: Run command service cnm restart at DUT0 and expect this output:

Step 9: Run command show running at DUT0 and expect this output:

Step 10: Run command show date at DUT0 and expect this output:

Telnet Privilege Map 

Description 

A TACACS+ server is added to a TACACS+ group which is added to an AAA list. This list is assigned to the login system’s authentication. Finally, the TACACS+ 0 and 15 privilege levels are mapped to locally defined roles. The device then starts a Telnet session with itself to check that it can only run the commands that role is authorized to run.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set service telnet
set system aaa authorization privilege-map tacacs 0 role admin
set system aaa authorization privilege-map tacacs 15 role monitor
set system aaa group tacacs tacgroup1 server serv1
set system aaa list list1 method 1 group tacacs tacgroup1
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX19Xm1idA5n4F+zqGsnKEoNmZ09GJou8MBM=
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 4: Run command service cnm restart at DUT0 and expect this output:

Step 5: Run command show running at DUT0 and expect this output:

Step 6: Run command show date at DUT0 and expect this output:

Step 7: Init a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 8: Run command service cnm restart at DUT0 and expect this output:

Step 9: Run command show running at DUT0 and expect this output:

Step 10: Run command show date at DUT0 and expect this output:

SSH Default Authorization 

Description 

A TACACS+ server is added to a TACACS+ group which is added to an AAA list. This list is assigned to the SSH service’s authentication. In this scenario, the default authorization mapping is used, which maps the privilege level 0 to monitor, 5 to operator, and 15 to admin. The device then starts an SSH session with itself to check that it can only run the commands that role is authorized to run.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication list1
set system aaa group tacacs tacgroup1 server serv1
set system aaa list list1 method 1 group tacacs tacgroup1
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX1+btLh9F/87wClWFxTgq7bbv/0u0D9n+Gc=
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testing:

admin@DUT0$ ssh testing@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 4: Run command service cnm restart at DUT0 and expect this output:

Step 5: Run command show running at DUT0 and expect this output:

Step 6: Run command show date at DUT0 and expect this output:

Step 7: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testadmin:

admin@DUT0$ ssh testadmin@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 8: Run command service cnm restart at DUT0 and expect this output:

Step 9: Run command show running at DUT0 and expect this output:

Step 10: Run command show date at DUT0 and expect this output:

SSH Privilege Map 

Description 

A TACACS+ server is added to a TACACS+ group which is added to an AAA list. This list is assigned to the SSH service’s authentication. Finally, the TACACS+ 0 and 15 privilege levels are mapped to locally defined roles. The device then starts an SSH session with itself to check that it can only run the commands that role is authorized to run.

Scenario 

Step 1: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication list1
set system aaa authorization privilege-map tacacs 0 role admin
set system aaa authorization privilege-map tacacs 15 role monitor
set system aaa group tacacs tacgroup1 server serv1
set system aaa list list1 method 1 group tacacs tacgroup1
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX18BjiMsq4RnpJX/IzQycw+AQleeGasrgyE=
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testing:

admin@DUT0$ ssh testing@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 4: Run command service cnm restart at DUT0 and expect this output:

Step 5: Run command show running at DUT0 and expect this output:

Step 6: Run command show date at DUT0 and expect this output:

Step 7: Init an SSH connection from DUT0 to IP address 127.0.0.1 with the user testadmin:

admin@DUT0$ ssh testadmin@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 8: Run command service cnm restart at DUT0 and expect this output:

Step 9: Run command show running at DUT0 and expect this output:

Step 10: Run command show date at DUT0 and expect this output: