Tacacs

Telnet Default Authorization 

Description 

A TACACS+ server is added to a TACACS+ group which is added to an AAA list. This list is assigned to the login system’s authentication. In this scenario, the default authorization mapping is used, which maps the privilege level 0 to monitor, 5 to operator, and 15 to admin. The device then starts a Telnet session with itself to check that it can only run the commands that role is authorized to run.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service telnet
set system aaa group tacacs tacgroup1 server serv1
set system aaa list list1 method 1 group tacacs tacgroup1
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX1+6kXdOQ99iVldb+JlknS/ugjiJz6QhNMQ=
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Initiate a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 4: Run the command service cnm restart on DUT0 and expect the following output:

Step 5: Run the command show running on DUT0 and expect the following output:

Step 6: Run the command show date on DUT0 and expect the following output:

Step 7: Initiate a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 8: Run the command service cnm restart on DUT0 and expect the following output:

Step 9: Run the command show running on DUT0 and expect the following output:

Step 10: Run the command show date on DUT0 and expect the following output:

Telnet Privilege Map 

Description 

A TACACS+ server is added to a TACACS+ group which is added to an AAA list. This list is assigned to the login system’s authentication. Finally, the TACACS+ 0 and 15 privilege levels are mapped to locally defined roles. The device then starts a Telnet session with itself to check that it can only run the commands that role is authorized to run.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service telnet
set system aaa authorization privilege-map tacacs 0 role admin
set system aaa authorization privilege-map tacacs 15 role monitor
set system aaa authorization privilege-map tacacs 3 role operator
set system aaa group tacacs tacgroup1 server serv1
set system aaa list list1 method 1 group tacacs tacgroup1
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX1/fXEppmSllou+KXaC3woUPaOhaRPxTKr8=
set system login aaa authentication list1
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Initiate a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 4: Run the command service cnm restart on DUT0 and expect the following output:

Step 5: Run the command show running on DUT0 and expect the following output:

Step 6: Run the command show date on DUT0 and expect the following output:

Step 7: Initiate a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 8: Run the command service cnm restart on DUT0 and expect the following output:

Step 9: Run the command show running on DUT0 and expect the following output:

Step 10: Run the command show date on DUT0 and expect the following output:

Step 11: Initiate a Telnet connection from DUT0 to IP address 127.0.0.1 :

admin@DUT0$ telnet 127.0.0.1

Step 12: Run the command service cnm restart on DUT0 and expect the following output:

Step 13: Run the command show running on DUT0 and expect the following output:

Step 14: Run the command show date on DUT0 and expect the following output:

SSH Default Authorization 

Description 

A TACACS+ server is added to a TACACS+ group which is added to an AAA list. This list is assigned to the SSH service’s authentication. In this scenario, the default authorization mapping is used, which maps the privilege level 0 to monitor, 5 to operator, and 15 to admin. The device then starts an SSH session with itself to check that it can only run the commands that role is authorized to run.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication list1
set system aaa group tacacs tacgroup1 server serv1
set system aaa list list1 method 1 group tacacs tacgroup1
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX188BINGO4ianpf7HTxU7p6j5HTQ0MqDWlo=
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Initiate an SSH connection from DUT0 to IP address 127.0.0.1 using user testing:

admin@DUT0$ ssh testing@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 4: Run the command service cnm restart on DUT0 and expect the following output:

Step 5: Run the command show running on DUT0 and expect the following output:

Step 6: Run the command show date on DUT0 and expect the following output:

Step 7: Initiate an SSH connection from DUT0 to IP address 127.0.0.1 using user testadmin:

admin@DUT0$ ssh testadmin@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 8: Run the command service cnm restart on DUT0 and expect the following output:

Step 9: Run the command show running on DUT0 and expect the following output:

Step 10: Run the command show date on DUT0 and expect the following output:

SSH Privilege Map 

Description 

A TACACS+ server is added to a TACACS+ group which is added to an AAA list. This list is assigned to the SSH service’s authentication. Finally, the TACACS+ 0 and 15 privilege levels are mapped to locally defined roles. The device then starts an SSH session with itself to check that it can only run the commands that role is authorized to run.

Scenario 

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set service ssh aaa authentication list1
set system aaa authorization privilege-map tacacs 0 role admin
set system aaa authorization privilege-map tacacs 15 role monitor
set system aaa authorization privilege-map tacacs 3 role operator
set system aaa group tacacs tacgroup1 server serv1
set system aaa list list1 method 1 group tacacs tacgroup1
set system aaa server tacacs serv1 address 10.215.168.1
set system aaa server tacacs serv1 encrypted-key U2FsdGVkX1//u/5oovbjN/j3elGGns7ojo26KebjNNg=
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Step 3: Initiate an SSH connection from DUT0 to IP address 127.0.0.1 using user testing:

admin@DUT0$ ssh testing@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 4: Run the command service cnm restart on DUT0 and expect the following output:

Step 5: Run the command show running on DUT0 and expect the following output:

Step 6: Run the command show date on DUT0 and expect the following output:

Step 7: Initiate an SSH connection from DUT0 to IP address 127.0.0.1 using user tacthree:

admin@DUT0$ ssh tacthree@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 8: Run the command service cnm restart on DUT0 and expect the following output:

Step 9: Run the command show running on DUT0 and expect the following output:

Step 10: Run the command show date on DUT0 and expect the following output:

Step 11: Initiate an SSH connection from DUT0 to IP address 127.0.0.1 using user testadmin:

admin@DUT0$ ssh testadmin@127.0.0.1 option StrictHostKeyChecking=no option UserKnownHostsFile=/dev/null

Step 12: Run the command service cnm restart on DUT0 and expect the following output:

Step 13: Run the command show running on DUT0 and expect the following output:

Step 14: Run the command show date on DUT0 and expect the following output: