NSS plugin to lookup tacacs client username, and match mapped user after login (mirror of https://github.com/vyos/libnss-tacplus.git) https://git.amelek.net/vyos/libnss-tacplus.git/atom?h=master 2024-04-29T18:58:47+00:00 2024-04-29T18:58:47+00:00 Christian Breunig christian@breunig.cc 2024-04-29T18:58:47+00:00 urn:sha1:049d2843b521d15e2f355430d94eb9d2e83311be 2017-05-23T23:34:57+00:00 Dave Olson olson@cumulusnetworks.com 2017-03-07T20:59:42+00:00 urn:sha1:52aa2d434ed03f0a386eb3bb6a12cb83b0c005c6 When management vrf is enabled and vrf is present in the tacacs config, if we are unable to reach any configured tacacs server, try setting vrf context on the socket. Previously libnss-tacplus worked only with ssh@mgmt, now works with normal ssh in mgmt vrf Setting via the socket (rather than vrf context) is required so we don't set the VRF context for arbitrary processes that do uid or username lookups. 2016-10-06T21:20:11+00:00 Dave Olson olson@cumulusnetworks.com 2016-08-20T06:57:42+00:00 urn:sha1:3279fbbb9e0f3744623fbb6a2d658d6ff5ab3f0d size_t is only an int on 32 bit ARM, so %ld gives an error. Add a cast. 2016-06-28T22:45:47+00:00 Dave Olson olson@cumulusnetworks.com 2016-06-23T20:39:25+00:00 urn:sha1:ab9634da79286d2f04f40011331f2feee208e513 Initial version with NSS lookups for tacacs users using mapping Works with modified libpam-tacplus to authenticate TACACS+ users without local passwd entries, mapping them to tacacs0..15 based on TACACS privilege level. When the /etc/tacplus_servers tacacs config file is mode 600 (normally the case since it has the server "secret" key), lookups will only work for tacacs users that are logged in, via the local mapping. For root, getpwnam lookups will work for any TACACS user known to the servers. Most syslog's enabled only if debug is set in the config file.