diff options
| author | zsdc <taras@vyos.io> | 2023-09-13 13:16:20 +0300 |
|---|---|---|
| committer | zsdc <taras@vyos.io> | 2023-11-20 18:46:24 +0200 |
| commit | 5d712700d6b8db43e36ad5f2a9f8792203bb12d0 (patch) | |
| tree | 57ca0315aaa64984a0bded43e22b3d0f53e3e2e1 /interface-definitions/system-login.xml.in | |
| parent | 2a023b878471500bd78962ca94d9174a328ce5c9 (diff) | |
| download | vyos-1x-5d712700d6b8db43e36ad5f2a9f8792203bb12d0.tar.gz vyos-1x-5d712700d6b8db43e36ad5f2a9f8792203bb12d0.zip | |
TACACS: T5577: Added `mandatory` and `optional` modes for TACACS+
In CLI we can choose authentication logic:
- `mandatory` - if TACACS+ answered with `REJECT`, authentication must be
stopped and access denied immediately.
- `optional` (default) - if TACACS+ answers with `REJECT`, authentication
continues using the next module.
In `mandatory` mode authentication will be stopped only if TACACS+ clearly
answered that access should be denied (no user in TACACS+ database, wrong
password, etc.). If TACACS+ is not available or other errors happen, it will be
skipped and authentication will continue with the next module, like in
`optional` mode.
Diffstat (limited to 'interface-definitions/system-login.xml.in')
| -rw-r--r-- | interface-definitions/system-login.xml.in | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/interface-definitions/system-login.xml.in b/interface-definitions/system-login.xml.in index a0eda9045..be0145b4f 100644 --- a/interface-definitions/system-login.xml.in +++ b/interface-definitions/system-login.xml.in @@ -244,6 +244,26 @@ </leafNode> </children> </tagNode> + <leafNode name="security-mode"> + <properties> + <help>Security mode for TACACS+ authentication</help> + <completionHelp> + <list>mandatory optional</list> + </completionHelp> + <valueHelp> + <format>mandatory</format> + <description>Deny access immediately if TACACS+ answers with REJECT</description> + </valueHelp> + <valueHelp> + <format>optional</format> + <description>Pass to the next authentication method if TACACS+ answers with REJECT</description> + </valueHelp> + <constraint> + <regex>(mandatory|optional)</regex> + </constraint> + </properties> + <defaultValue>optional</defaultValue> + </leafNode> #include <include/source-address-ipv4.xml.i> #include <include/radius-timeout.xml.i> #include <include/interface/vrf.xml.i> |