summaryrefslogtreecommitdiff
path: root/src/pam-configs/tacplus-mandatory
diff options
context:
space:
mode:
authorzsdc <taras@vyos.io>2023-09-13 13:16:20 +0300
committerzsdc <taras@vyos.io>2023-09-13 21:02:32 +0300
commit1c804685d05ad639bcb1a9ebce68a7a14268500f (patch)
treeb42c8e4ec1e0fa06699966ff6b72ba8b9f3415dd /src/pam-configs/tacplus-mandatory
parent5181ab60bb6d936505967d6667adc12c5ecb9b64 (diff)
downloadvyos-1x-1c804685d05ad639bcb1a9ebce68a7a14268500f.tar.gz
vyos-1x-1c804685d05ad639bcb1a9ebce68a7a14268500f.zip
TACACS: T5577: Added `mandatory` and `optional` modes for TACACS+
In CLI we can choose authentication logic: - `mandatory` - if TACACS+ answered with `REJECT`, authentication must be stopped and access denied immediately. - `optional` (default) - if TACACS+ answers with `REJECT`, authentication continues using the next module. In `mandatory` mode authentication will be stopped only if TACACS+ clearly answered that access should be denied (no user in TACACS+ database, wrong password, etc.). If TACACS+ is not available or other errors happen, it will be skipped and authentication will continue with the next module, like in `optional` mode.
Diffstat (limited to 'src/pam-configs/tacplus-mandatory')
-rw-r--r--src/pam-configs/tacplus-mandatory19
1 files changed, 19 insertions, 0 deletions
diff --git a/src/pam-configs/tacplus-mandatory b/src/pam-configs/tacplus-mandatory
new file mode 100644
index 000000000..92da02327
--- /dev/null
+++ b/src/pam-configs/tacplus-mandatory
@@ -0,0 +1,19 @@
+Name: TACACS+ authentication (mandatory mode)
+Default: no
+Priority: 576
+
+Auth-Type: Primary
+Auth-Initial:
+ [default=ignore success=end perm_denied=bad auth_err=bad] pam_tacplus.so include=/etc/tacplus_servers login=login
+Auth:
+ [default=ignore success=end perm_denied=bad auth_err=bad] pam_tacplus.so include=/etc/tacplus_servers login=login use_first_pass
+
+Account-Type: Primary
+Account:
+ [default=ignore success=1] pam_succeed_if.so user notingroup tacacs quiet
+ [default=ignore new_authtok_reqd=done success=end perm_denied=bad auth_err=bad] pam_tacplus.so include=/etc/tacplus_servers login=login
+
+Session-Type: Additional
+Session:
+ [default=ignore success=1] pam_succeed_if.so user notingroup tacacs quiet
+ [default=ignore success=ok perm_denied=bad auth_err=bad] pam_tacplus.so include=/etc/tacplus_servers login=login