tac_plus活動目錄配置

我似乎有問題與公益tac_plus配置。tac_plus活動目錄配置

我的開關是給我下面的日誌消息

5月4日20點58分52秒SV5-C1-R104-AE02 AAA：AAA％-4-EXEC_AUTHZ_FAILED：用戶jdambly失敗的授權，以啓動一個shell

如果我看tac_plus日誌，它看起來像我的組映射配置不正確，這裏是日誌

May 4 14:04:22 neteng tac_plus[14476]: 1/9a920270: Start authorization request 
May 4 14:04:22 neteng tac_plus[14476]: 1/9a920270: cfg_get: checking user/group jdambly, tag (NULL) 
May 4 14:04:22 neteng tac_plus[14476]: 1/9a920270: cfg_get: checking user/group jdambly, tag (NULL) 
May 4 14:04:22 neteng tac_plus[14476]: 1/9a920270: user 'jdambly' found 
May 4 14:04:22 neteng tac_plus[14476]: 1/9a920270: cfg_get: checking user/group jdambly, tag (NULL) 
May 4 14:04:22 neteng tac_plus[14476]: 1/9a920270: [email protected]: not found: [email protected] protocol= 
May 4 14:04:22 neteng tac_plus[14476]: 1/9a920270: [email protected]: not found: svcname=shell protocol= 
May 4 14:04:22 neteng tac_plus[14476]: 1/9a920270: [email protected]: svcname=shell protocol= not found, default is <unknown> 
May 4 14:04:22 neteng tac_plus[14476]: 1/9a920270: Writing AUTHOR/FAIL size=18

這裏是我的配置

ID = TA c_plus { 調試= PACKET認證介紹作者MAVIS

access log = /var/log/tac_plus/access.log 
    accounting log = /var/log/tac_plus/acct.log 
    authorization log = /var/log/tac_plus/auth.log 

    mavis module = external { 
      setenv LDAP_SERVER_TYPE = "microsoft" 
      #setenv LDAP_HOSTS = "ldaps://xxxxxx:3268" 
      setenv LDAP_HOSTS = "xxxxxx:3268" 
      setenv LDAP_SCOPE = sub 
      setenv LDAP_BASE = "dc=nskope,dc=net" 
      setenv LDAP_FILTER = "(&(objectclass=user)(sAMAccountName=%s))" 
      setenv LDAP_USER = "[email protected]" 
      setenv LDAP_PASSWD = "xxxxxxxx" 
      #setenv AD_GROUP_PREFIX = devops 
      # setenv REQUIRE_AD_GROUP_PREFIX = 1 
      # setenv USE_TLS = 0 
      exec = /usr/local/lib/mavis/mavis_tacplus_ldap.pl 
    } 

    user backend = mavis 
    login backend = mavis 
    pap backend = mavis 
    skip missing groups = yes 
    host = world { 
      address = 0.0.0/0 
      prompt = "Welcome\n" 
      key = cisco 
    } 

    group = devops { 
      default service = permit 
      service = shell { 
        default command = permit 
        default attribute = permit 
        set priv-lvl = 15 
      } 
    }

}

我試圖映射廣告組的DevOps在配置的組，但我認爲這失敗，我不知道爲什麼

來源

2016-05-04 Jeff d' Ambly

so LONG故事短我使用以下配置得到了這個工作。

#!../../../sbin/tac_plus 

id = spawnd { 
    listen = { port = 49 } 
    spawn = { 
      instances min = 1 
      instances max = 10 
    } 
    background = no 
} 

id = tac_plus { 
    debug = PACKET AUTHEN AUTHOR MAVIS 

    access log = /var/log/tac_plus/access.log 
    accounting log = /var/log/tac_plus/acct.log 
    authorization log = /var/log/tac_plus/auth.log 

    mavis module = external { 
      setenv LDAP_SERVER_TYPE = "microsoft" 
      #setenv LDAP_HOSTS = "ldaps://xxxxxxxxx:3268" 
      setenv LDAP_HOSTS = "xxxxxxxxx:3268" 
      #setenv LDAP_SCOPE = sub 
      setenv LDAP_BASE = "cn=Users,dc=nskope,dc=net" 
      setenv LDAP_FILTER = "(&(objectclass=user)(sAMAccountName=%s))" 
      setenv LDAP_USER = "xxxxxxxx" 
      setenv LDAP_PASSWD = "xxxxxxxx" 
      #setenv FLAG_FALLTHROUGH=1 
      setenv UNLIMIT_AD_GROUP_MEMBERSHIP = "1" 
      #setenv EXPAND_AD_GROUP_MEMBERSHIP=1 
      #setenv FLAG_USE_MEMBEROF = 1 
      setenv AD_GROUP_PREFIX = "" 
      # setenv REQUIRE_AD_GROUP_PREFIX = 1 
      # setenv USE_TLS = 0 
      exec = /usr/local/lib/mavis/mavis_tacplus_ldap.pl 
    } 

    user backend = mavis 
    login backend = mavis 
    pap backend = mavis 
    skip missing groups = yes 
    host = world { 
      address = 0.0.0/0 
      #prompt = "Welcome\n" 
      key = cisco 
    } 

    group = devops { 
      default service = permit 
      service = shell { 
        default command = permit 
        default attribute = permit 
        set priv-lvl = 15 
      } 
    }

}

真正的伎倆是增加

setenv UNLIMIT_AD_GROUP_MEMBERSHIP = "1" 
setenv AD_GROUP_PREFIX = ""

使用這些設置它不是尋找一個前綴所有廣告組。此配置允許將廣告組直接映射到此文件中配置的組，在我的情況下，該組稱爲dev操作。還要注意，我必須在1附近使用引號，如果沒有這些任務，它不會將var UNLIMIT_AD_GROUP_MEMBERSHIP設置爲1，所以請注意這一點。希望這可以幫助別人，使他們不必經歷我所做的所有痛苦;）

來源

2016-05-04 23:08:53

tac_plus活動目錄配置

回答

相關問題