summaryrefslogtreecommitdiff
path: root/src/conf_mode
diff options
context:
space:
mode:
authorzsdc <taras@vyos.io>2023-09-13 13:16:20 +0300
committerzsdc <taras@vyos.io>2023-09-13 21:02:32 +0300
commit1c804685d05ad639bcb1a9ebce68a7a14268500f (patch)
treeb42c8e4ec1e0fa06699966ff6b72ba8b9f3415dd /src/conf_mode
parent5181ab60bb6d936505967d6667adc12c5ecb9b64 (diff)
downloadvyos-1x-1c804685d05ad639bcb1a9ebce68a7a14268500f.tar.gz
vyos-1x-1c804685d05ad639bcb1a9ebce68a7a14268500f.zip
TACACS: T5577: Added `mandatory` and `optional` modes for TACACS+
In CLI we can choose authentication logic: - `mandatory` - if TACACS+ answered with `REJECT`, authentication must be stopped and access denied immediately. - `optional` (default) - if TACACS+ answers with `REJECT`, authentication continues using the next module. In `mandatory` mode authentication will be stopped only if TACACS+ clearly answered that access should be denied (no user in TACACS+ database, wrong password, etc.). If TACACS+ is not available or other errors happen, it will be skipped and authentication will continue with the next module, like in `optional` mode.
Diffstat (limited to 'src/conf_mode')
-rwxr-xr-xsrc/conf_mode/system-login.py11
1 files changed, 7 insertions, 4 deletions
diff --git a/src/conf_mode/system-login.py b/src/conf_mode/system-login.py
index be5ff2d4c..87a269499 100755
--- a/src/conf_mode/system-login.py
+++ b/src/conf_mode/system-login.py
@@ -389,11 +389,14 @@ def apply(login):
pam_profile = 'radius-optional'
cmd(f'pam-auth-update --enable {pam_profile}')
- # Enable/Disable TACACS in PAM configuration
- pam_cmd = '--remove'
+ # Enable/disable TACACS+ in PAM configuration
+ cmd('pam-auth-update --disable tacplus-mandatory tacplus-optional')
if 'tacacs' in login:
- pam_cmd = '--enable'
- cmd(f'pam-auth-update --package {pam_cmd} tacplus')
+ if login['tacacs'].get('security_mode', '') == 'mandatory':
+ pam_profile = 'tacplus-mandatory'
+ else:
+ pam_profile = 'tacplus-optional'
+ cmd(f'pam-auth-update --enable {pam_profile}')
return None