Inhaltsverzeichnis

Projekt Rechnernetze

Automatische Konfiguration eines Labor-Routers mit Ansible und TACACS sowie automtische Überprüfung der Konfiguration mit PyATS

Organisation

Gruppenarbeit

Tools

Inhalt

TACACS

aaa new-model
!
aaa authentication login default group tacacs+ local
aaa authentication login CONSOLE none
aaa authorization config-commands
aaa authorization exec default group tacacs+ local 
aaa authorization commands 15 default group tacacs+ local
!
line con 0
 login authentication CONSOLE

Konfiguration: /etc/tacacs/tac_plus.conf 

# The TACASC shared-secret
key = labtacacskey 

# A full admin user called 'tacacs'
user = tacacs {
    # allows everything that is not forbidden
    default service = permit

    # Create a DES encrypted password with the `tac_pwd` command  
    login = des Oy6FGC2LNE6ao

    # Set priv 15 for user 
    service = exec {
        priv-lvl = 15
	}

    cmd = show {
        # deny show running-config, allow everything else (just a test)
	deny running-config
	}
    cmd = interface {
	deny "GigabitEthernet 0/1/0"
	permit "GigabitEthernet 0/0/1"
	permit "GigabitEthernet 0/0/0"
	}
}
TACACS Server