Tacacs and LDAP Integration

Tacacs+ doesn’t support LDAP authentication by default, but it does support PAM authentication.but you still must define users in your tac_plus.conf, and you must still define groups in tac_plus.conf.

Install Required package libpam0g-dev.

#apt install install libpam0g-dev

Create folder for tacac configuration file on /etc/tacacs

#mkdir /etc/tacacs

Download tacacs package from

#wget <https://shrubbery.net/pub/tac_plus/tacacs-F4.0.4.28.tar.gz>

Extract tacacs package

#tar -xzvf tacacs-F4.0.4.28.tar.gz

go to extracted folder, Now, we will configure and build the tac_plus packages on our server.

cd tacacs-F4.0.4.28
./configure

make sure checking for pam_start in -lpam… yes

make && make install

define a pam stack for tac_plus

cd /etc/pam.d

nano /etc/pam.d/tac_plus

add the configuration

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

account     required      pam_unix.so broken_shadow
account     sufficient    pam_localuser.so
account     sufficient    pam_succeed_if.so uid < 500 quiet
account     [default=bad success=ok user_unknown=ignore] pam_ldap.so
account     required      pam_permit.so

password    requisite     pam_cracklib.so try_first_pass retry=3
password    sufficient    pam_unix.so md5 shadow nullok try_first_pass
use_authtok
password    sufficient    pam_ldap.so use_authtok
password    required      pam_deny.so

session     optional      pam_keyinit.so revoke
session     required      pam_limits.so
session     [success=1 default=ignore] pam_succeed_if.so service in
crond quiet use_uid
session     required      pam_unix.so
session     optional      pam_ldap.so

Edit the tac_plus conf file, and define your users as such:

user = <ldap user id> {
   login = PAM
   <other options>
}

test tacacs auth with ldap users

tactest -s {{server_ip}} -k {{key}} -u {{user}} -p {{password}}

------------------

SUMMARY STATISTICS

------------------

Total Commands  .....................  1
Successes  ..........................  1
Failures  ...........................  0
No Results  .........................  0
Time Taken for commands  ............  0,261 secs
Avg Possible Transactions/Second  ...  3
Network Time per command  ...........  0,107 secs
Total Network time  .................  0,107 secs
Sent Transactions/Second  ...........  3,3