libnss-tacplus.git - NSS plugin to lookup tacacs client username, and match mapped user after login (mirror of https://github.com/vyos/libnss-tacplus.git)

Age	Commit message (Collapse)	Author
2016-11-23	Missed handling a secret/server ordering	Dave Olson
	secret=key1 secret=key2 server=server1 server=server2 Should result in pairing server1/key1 server2/key2. That case didn't work
2016-11-22	Handle case of secret parameter listed after multiple servers	Dave Olson
	Fixed this case: server=a.b.c.d server=b.d.e.f secret=stuff libpam-tacplus handled, but my code didn't.
2016-11-22	corrected the FSF zipcode	Dave Olson

2016-11-18	Handle case of secret parameter listed after multiple servers	Dave Olson
	Fixed this case: server=a.b.c.d server=b.d.e.f secret=stuff libpam-tacplus handled, but my code didn't.
2016-11-18	corrected the FSF zipcode	Dave Olson

2016-10-31	Fixed copyright punctuation error	Dave Olson

2016-10-26	Fixed trailing line whitespace issues	Dave Olson

2016-10-26	Updated COPYING, corrected copyrights	Dave Olson
	Also fixed some whitespace at end of lines
2016-10-26	Fixed a LOG_DEBUG message to be protected by if (debug)	Dave Olson

2016-10-26	Fixed a LOG_DEBUG message to be protected by if (debug)	Dave Olson

2016-10-21	Updated COPYING, corrected copyrights	Dave Olson

2016-10-07	Updated the README to not include PAM protocols, and add new variables	Dave Olson
	Documented the min_uid and exclude_users config file variables.
2016-10-07	Updated the README to not include PAM protocols, and add new variables	Dave Olson
	Documented the min_uid and exclude_users config file variables.
2016-10-06	Add ability to skip lookups on list of account names, and minimum UID	Dave Olson
	Ticket: CM-13109 This is both for performance and robustness. It also avoids warnings during bootup when networking isn't yet up. Also minor improvements to debug messages
2016-10-06	Better debugs for server, and try all servers in list	Dave Olson
	Ticket: CM-13049 Reviewed By: olson Testing Done: tried multiple servers. Debugging a customer issue was harder than it should be, so add more debugging on success and invalid user returns from server. Also try all servers in the list until success, because different servers can have different databases, so an invalid user return from one server should not be considered definitive.
2016-10-06	When recursing into an included config, don't reset secret key index	Dave Olson
	Ticket: CM-12880 Reviewed By: olson Testing Done: built, ran through test case. When recursing do to an included config file, the tac_key_no index into the server array was always starting at zero, so if there were server/key pairs in both the main config file and the included file, the secret from the 0th entry was being used for each, and we weren't adding the servers from the origianl config file. Make tac_key_no global like tac_srv_no
2016-10-06	Fix 32-bit system build error	Dave Olson
	size_t is only an int on 32 bit ARM, so %ld gives an error. Add a cast.
2016-10-06	Provide getpwnam_r entry point to lookup mapped TACACS+ users	Dave Olson
	Initial version with NSS lookups for tacacs users using mapping Works with modified libpam-tacplus to authenticate TACACS+ users without local passwd entries, mapping them to tacacs0..15 based on TACACS privilege level. When the /etc/tacplus_servers tacacs config file is mode 600 (normally the case since it has the server "secret" key), lookups will only work for tacacs users that are logged in, via the local mapping. For root, getpwnam lookups will work for any TACACS user known to the servers. Most syslog's enabled only if debug is set in the config file.
2016-06-28	Provide getpwnam_r entry point to lookup mapped TACACS+ users	Dave Olson
	Initial version with NSS lookups for tacacs users using mapping Works with modified libpam-tacplus to authenticate TACACS+ users without local passwd entries, mapping them to tacacs0..15 based on TACACS privilege level. When the /etc/tacplus_servers tacacs config file is mode 600 (normally the case since it has the server "secret" key), lookups will only work for tacacs users that are logged in, via the local mapping. For root, getpwnam lookups will work for any TACACS user known to the servers. Most syslog's enabled only if debug is set in the config file.