summaryrefslogtreecommitdiff
path: root/debian
diff options
context:
space:
mode:
authorzsdc <taras@vyos.io>2023-09-13 13:16:20 +0300
committerzsdc <taras@vyos.io>2023-11-20 18:46:24 +0200
commit5d712700d6b8db43e36ad5f2a9f8792203bb12d0 (patch)
tree57ca0315aaa64984a0bded43e22b3d0f53e3e2e1 /debian
parent2a023b878471500bd78962ca94d9174a328ce5c9 (diff)
downloadvyos-1x-5d712700d6b8db43e36ad5f2a9f8792203bb12d0.tar.gz
vyos-1x-5d712700d6b8db43e36ad5f2a9f8792203bb12d0.zip
TACACS: T5577: Added `mandatory` and `optional` modes for TACACS+
In CLI we can choose authentication logic: - `mandatory` - if TACACS+ answered with `REJECT`, authentication must be stopped and access denied immediately. - `optional` (default) - if TACACS+ answers with `REJECT`, authentication continues using the next module. In `mandatory` mode authentication will be stopped only if TACACS+ clearly answered that access should be denied (no user in TACACS+ database, wrong password, etc.). If TACACS+ is not available or other errors happen, it will be skipped and authentication will continue with the next module, like in `optional` mode.
Diffstat (limited to 'debian')
-rw-r--r--debian/vyos-1x.postinst6
-rw-r--r--debian/vyos-1x.preinst1
2 files changed, 5 insertions, 2 deletions
diff --git a/debian/vyos-1x.postinst b/debian/vyos-1x.postinst
index 837fcf995..22b50ce2a 100644
--- a/debian/vyos-1x.postinst
+++ b/debian/vyos-1x.postinst
@@ -48,6 +48,11 @@ if grep -q '^tacacs' /etc/passwd; then
fi
fi
+# Remove TACACS+ PAM default profile
+if [[ -e /usr/share/pam-configs/tacplus ]]; then
+ rm /usr/share/pam-configs/tacplus
+fi
+
# Add TACACS system users required for TACACS based system authentication
if ! grep -q '^tacacs' /etc/passwd; then
# Add the tacacs group and all 16 possible tacacs privilege-level users to
@@ -66,7 +71,6 @@ if ! grep -q '^tacacs' /etc/passwd; then
adduser --quiet tacacs${level} adm
adduser --quiet tacacs${level} dip
adduser --quiet tacacs${level} users
- adduser --quiet tacacs${level} aaa
if [ $level -lt 15 ]; then
adduser --quiet tacacs${level} vyattaop
adduser --quiet tacacs${level} operator
diff --git a/debian/vyos-1x.preinst b/debian/vyos-1x.preinst
index df99661b1..fbfc85566 100644
--- a/debian/vyos-1x.preinst
+++ b/debian/vyos-1x.preinst
@@ -2,7 +2,6 @@ dpkg-divert --package vyos-1x --add --no-rename /etc/securetty
dpkg-divert --package vyos-1x --add --no-rename /etc/security/capability.conf
dpkg-divert --package vyos-1x --add --no-rename /lib/systemd/system/lcdproc.service
dpkg-divert --package vyos-1x --add --no-rename /etc/logrotate.d/conntrackd
-dpkg-divert --package vyos-1x --add --no-rename /usr/share/pam-configs/tacplus
dpkg-divert --package vyos-1x --add --no-rename /etc/rsyslog.conf
dpkg-divert --package vyos-1x --add --no-rename /etc/skel/.bashrc
dpkg-divert --package vyos-1x --add --no-rename /etc/skel/.profile