TACACS
NVOS implements TACACS+ client AAA (Accounting, Authentication, and Authorization) in a transparent way with minimal configuration. The client implements the TACACS+ protocol as described in this IETF document. There is no need to create accounts or directories on the switch. Accounting records go to all configured TACACS+ servers by default. Using per-command authorization requires additional setup on the switch.
Authentication using PAM: includes
login,ssh,sudoandsuRuns over the eth0 management interface
Up to eight TACACS+ servers
TACACS configuration is made of global configurations and per-server configurations. In general, if per-server configuration is not defined, the configuration will be taken from the global configuration.
All nv tacacs commands can be found in TACACS Commands, where global ones are direct under /system/aaa/tacacs and per-server ones or under /system/aaa/tacacs/hostname/<hostname-id>.
NVOS supports three types of RADIUS users defined by priv-lvl configured in TACACS server.
priv-lvl=15 # admin privileged users (nv set, nv config apply)
priv-lvl=7 # monitor privileged users (nv show)
priv-lvl=1 # non-privileged users (no nv commands access
TACACS Server Setup and Usage Example
TACACS server can be configured either on a remote host or on the switch itself (for testing or sanity-check).
Basic configuration for users and clients can be done in /etc/tacplus_nss.conf file.
Users Configuration
user = username {
login = cleartext "login_password"
pap = cleartext "pap_password"
service = exec {
priv-lvl=<15,7,1>
}
}
Client Configuration
Client configuration allows specific client IPs and CIDR blocks.
key = "client-secret"
and:
acl = default {
#permit = 192\.168\.0\.
permit = 10\.7\.140\.30
permit = .*
}
After configuring a tacacs server, configure the client:
admin@nvos:~$ nv set system aaa tacacs hostname <tacacs-server-ip> secret tacacs-secret
admin@nvos:~$ nv set system aaa authentication order tacacs,local
admin@nvos:~$ nv config apply -y
TACACS Accounting Configuration
TACACS accounting logs user activity and commands executed on the system, providing an audit trail for security and compliance. It ensures accountability by sending these logs to configured TACACS+ servers. The logs will be sent to the first server to respond.
TACACS accounting is managed under the /etc/tacplus_nss.conf file.
After configuring a TACACS server and client, enable accounting with the command nv set system aaa tacacs accounting state enabled.