summaryrefslogtreecommitdiff
path: root/interface-definitions
diff options
context:
space:
mode:
authorzsdc <taras@vyos.io>2023-09-13 13:16:20 +0300
committerzsdc <taras@vyos.io>2023-11-20 18:46:24 +0200
commit5d712700d6b8db43e36ad5f2a9f8792203bb12d0 (patch)
tree57ca0315aaa64984a0bded43e22b3d0f53e3e2e1 /interface-definitions
parent2a023b878471500bd78962ca94d9174a328ce5c9 (diff)
downloadvyos-1x-5d712700d6b8db43e36ad5f2a9f8792203bb12d0.tar.gz
vyos-1x-5d712700d6b8db43e36ad5f2a9f8792203bb12d0.zip
TACACS: T5577: Added `mandatory` and `optional` modes for TACACS+
In CLI we can choose authentication logic: - `mandatory` - if TACACS+ answered with `REJECT`, authentication must be stopped and access denied immediately. - `optional` (default) - if TACACS+ answers with `REJECT`, authentication continues using the next module. In `mandatory` mode authentication will be stopped only if TACACS+ clearly answered that access should be denied (no user in TACACS+ database, wrong password, etc.). If TACACS+ is not available or other errors happen, it will be skipped and authentication will continue with the next module, like in `optional` mode.
Diffstat (limited to 'interface-definitions')
-rw-r--r--interface-definitions/system-login.xml.in20
1 files changed, 20 insertions, 0 deletions
diff --git a/interface-definitions/system-login.xml.in b/interface-definitions/system-login.xml.in
index a0eda9045..be0145b4f 100644
--- a/interface-definitions/system-login.xml.in
+++ b/interface-definitions/system-login.xml.in
@@ -244,6 +244,26 @@
</leafNode>
</children>
</tagNode>
+ <leafNode name="security-mode">
+ <properties>
+ <help>Security mode for TACACS+ authentication</help>
+ <completionHelp>
+ <list>mandatory optional</list>
+ </completionHelp>
+ <valueHelp>
+ <format>mandatory</format>
+ <description>Deny access immediately if TACACS+ answers with REJECT</description>
+ </valueHelp>
+ <valueHelp>
+ <format>optional</format>
+ <description>Pass to the next authentication method if TACACS+ answers with REJECT</description>
+ </valueHelp>
+ <constraint>
+ <regex>(mandatory|optional)</regex>
+ </constraint>
+ </properties>
+ <defaultValue>optional</defaultValue>
+ </leafNode>
#include <include/source-address-ipv4.xml.i>
#include <include/radius-timeout.xml.i>
#include <include/interface/vrf.xml.i>