summaryrefslogtreecommitdiff
path: root/scripts/system/vyatta_update_tacacs.pl
diff options
context:
space:
mode:
Diffstat (limited to 'scripts/system/vyatta_update_tacacs.pl')
-rwxr-xr-xscripts/system/vyatta_update_tacacs.pl129
1 files changed, 0 insertions, 129 deletions
diff --git a/scripts/system/vyatta_update_tacacs.pl b/scripts/system/vyatta_update_tacacs.pl
deleted file mode 100755
index c4684efe..00000000
--- a/scripts/system/vyatta_update_tacacs.pl
+++ /dev/null
@@ -1,129 +0,0 @@
-#!/usr/bin/perl
-
-# **** License ****
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful, but
-# WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
-# General Public License for more details.
-#
-# This code was originally developed by Vyatta, Inc.
-# Portions created by Vyatta are Copyright (C) 2007 Vyatta, Inc.
-# All Rights Reserved.
-#
-# **** End License ****
-
-use strict;
-use warnings;
-
-use lib "/opt/vyatta/share/perl5";
-use Vyatta::Config;
-
-## setup tacacs+ server info
-# add tacacs to PAM file
-sub add_tacacs {
- my $param_string = shift;
- my $pam = shift;
-
- my $cmd =
- 'sudo sh -c "'
- . 'sed -i \'s/^\(' . "$pam"
- . '\trequired\tpam_unix\.so.*\)$/' . "$pam"
- . '\tsufficient\tpam_tacplus.so\t'
- . "$param_string # Vyatta"
- . '\n\1/\' '
- . "/etc/pam.d/common-$pam\"";
-
- system($cmd);
- return 0 if ( $? >> 8 );
- return 1;
-}
-
-# remove tacacs from PAM files
-sub remove_tacacs {
- my $cmd =
- 'sudo sh -c "'
- . 'sed -i \'/\(.*pam_tacplus.*# Vyatta\)/ D\' '
- . '/etc/pam.d/common-auth '
- . '/etc/pam.d/common-account '
- . '/etc/pam.d/common-session "';
-
- system($cmd);
- return 0 if ( $? >> 8 );
- return 1;
-}
-
-# main tacacs
-# There is a race condition in here betwen radius and tacacs currently.
-# Also should probably add a chack to see if we ned to actually reconfig
-# PAM rather than jusy doing it each commit.
-# Finally, service and protocol will need to be removed. They are just
-# in there for troubleshootig purposes right now.
-#
-my $tconfig = new Vyatta::Config;
-if ( $tconfig->isDeleted("system login tacacs-plus") ) { remove_tacacs; }
-$tconfig->setLevel("system login tacacs-plus");
-my @tacacs_params = $tconfig->listNodes();
-
-if ( scalar(@tacacs_params) > 0 ) {
- remove_tacacs;
- my ( $acctall, $debug, $firsthit, $noencrypt );
- if ( $tconfig->exists("acct-all") ) { $acctall = 1; }
- if ( $tconfig->exists("debug") ) { $debug = 1; }
- if ( $tconfig->exists("first-hit") ) { $firsthit = 1; }
- if ( $tconfig->exists("no-encrypt") ) { $noencrypt = 1; }
- my $protocol = $tconfig->returnValue("protocol");
- my $secret = $tconfig->returnValue("secret");
- my $server = $tconfig->returnValue("server");
- my $service = $tconfig->returnValue("service");
-
- if ( $server ne '' && $secret ne '' ) {
- my ( $authstr, $accountstr, $sessionstr, $ip );
- my @servers = split /\s/, $server;
-
- ## 3 common options
- # encrypt this session
- if ( !$noencrypt ) { $authstr = "encrypt "; }
-
- # single secret
- $authstr .= "secret=$secret ";
-
- # and debug
- if ($debug) { $authstr .= "debug "; }
-
- ## now they get specific
- $accountstr = $sessionstr = $authstr;
-
- # can be multiple servers for auth and session
- foreach my $ip (@servers) {
- $authstr .= "server=$ip ";
- $sessionstr .= "server=$ip ";
- }
-
- # first hit for auth
- if ($firsthit) { $authstr .= "firsthit "; }
-
- # acctall for session
- if ($acctall) { $sessionstr .= "acctall "; }
-
- # service and protocol for account and session
- if ($service) {
- $accountstr .= "service=$service ";
- $sessionstr .= "service=$service ";
- }
- if ($protocol) {
- $accountstr .= "protocol=$protocol ";
- $sessionstr .= "protocol=$protocol ";
- }
-
- add_tacacs( "$authstr", "auth" );
- add_tacacs( "$accountstr", "account" );
- add_tacacs( "$sessionstr", "session" );
- }
- else { exit 1; }
-}
-
-exit 0;