diff options
| author | zsdc <taras@vyos.io> | 2023-09-13 13:16:20 +0300 |
|---|---|---|
| committer | zsdc <taras@vyos.io> | 2023-09-13 21:02:32 +0300 |
| commit | 1c804685d05ad639bcb1a9ebce68a7a14268500f (patch) | |
| tree | b42c8e4ec1e0fa06699966ff6b72ba8b9f3415dd /src/pam-configs/tacplus | |
| parent | 5181ab60bb6d936505967d6667adc12c5ecb9b64 (diff) | |
| download | vyos-1x-1c804685d05ad639bcb1a9ebce68a7a14268500f.tar.gz vyos-1x-1c804685d05ad639bcb1a9ebce68a7a14268500f.zip | |
TACACS: T5577: Added `mandatory` and `optional` modes for TACACS+
In CLI we can choose authentication logic:
- `mandatory` - if TACACS+ answered with `REJECT`, authentication must be
stopped and access denied immediately.
- `optional` (default) - if TACACS+ answers with `REJECT`, authentication
continues using the next module.
In `mandatory` mode authentication will be stopped only if TACACS+ clearly
answered that access should be denied (no user in TACACS+ database, wrong
password, etc.). If TACACS+ is not available or other errors happen, it will be
skipped and authentication will continue with the next module, like in
`optional` mode.
Diffstat (limited to 'src/pam-configs/tacplus')
| -rw-r--r-- | src/pam-configs/tacplus | 17 |
1 files changed, 0 insertions, 17 deletions
diff --git a/src/pam-configs/tacplus b/src/pam-configs/tacplus deleted file mode 100644 index 66a1eaa4c..000000000 --- a/src/pam-configs/tacplus +++ /dev/null @@ -1,17 +0,0 @@ -Name: TACACS+ authentication -Default: no -Priority: 257 -Auth-Type: Primary -Auth: - [default=ignore success=ignore] pam_succeed_if.so user ingroup aaa quiet - [authinfo_unavail=ignore success=end auth_err=bad default=ignore] pam_tacplus.so include=/etc/tacplus_servers login=login - -Account-Type: Primary -Account: - [default=ignore success=ignore] pam_succeed_if.so user ingroup aaa quiet - [authinfo_unavail=ignore success=end perm_denied=bad default=ignore] pam_tacplus.so include=/etc/tacplus_servers login=login - -Session-Type: Additional -Session: - [default=ignore success=ignore] pam_succeed_if.so user ingroup aaa quiet - [authinfo_unavail=ignore success=ok default=ignore] pam_tacplus.so include=/etc/tacplus_servers login=login |