![TACACS+ 配置:如何接收 priv-lvl 值?](https://linux22.com/image/666984/TACACS%2B%20%E9%85%8D%E7%BD%AE%EF%BC%9A%E5%A6%82%E4%BD%95%E6%8E%A5%E6%94%B6%20priv-lvl%20%E5%80%BC%EF%BC%9F.png)
我需要配置 TACACS+ 服务器以了解给定用户是否经过身份验证*以及他的权限级别是多少。作为客户端,我使用 tactest (tacacs.net) 和 TACACS+ 客户端 Java 库 (AXL)。
我尝试过这个:
user = admin {
name = “Admin User”
login = cleartext admin
service = exec {
priv-lvl = 10
}
}
并且可以作为管理员进行身份验证,但无法获取他的特权级别。
以下是 tactest 的输出:
C:\Program Files (x86)\TACACS.net>tactest -s x.x.x.x -k testing123 -u admin -p admin -author -service exec
Trying to open connection to x.x.x.x:49
Sending:
MajorVersion=12
MinorVersion=0
Type=Authorization
SeqNum=1
IsEncrypted=True
IsSingleConnect=True
SessionID=494431516
DataLength=37
Authorization Method=Debug
Priv lvl=1
Auth Type=Ascii
Service=None
User=admin
Port=
Rem Addr=
Args: service=exec
Received Header:
MajorVersion=12
MinorVersion=0
Type=Authorization
SeqNum=2
IsEncrypted=True
IsSingleConnect=False
SessionID=494431516
DataLength=6
Received Body:
Authorization Status=PassAdd
User=
Port=
Args:
Command Pass status = True, Message=,
------------------
SUMMARY STATISTICS
------------------
Total Commands ..................... 1
Successes .......................... 1
Failures ........................... 0
No Results ......................... 0
Time Taken for commands ............ 0,066 secs
Avg Possible Transactions/Second ... 15
Network Time per command ........... 0,017 secs
Total Network time ................. 0,017 secs
Sent Transactions/Second ........... 11,1
有没有办法获取该属性值?
*我知道这不仅是身份验证,也是一种授权
答案1
我终于找到了解决方案。我只需要将服务名称更改为其他名称:
user = admin {
name = “Admin User”
login = cleartext admin
service = myservice {
priv-lvl = 10
}
}
然后我就能在客户端获得 AV 对了:
Received Header:
MajorVersion=12
MinorVersion=0
Type=Authorization
SeqNum=2
IsEncrypted=True
IsSingleConnect=False
SessionID=952769599
DataLength=18
Received Body:
Authorization Status=PassAdd
User=
Port=
Args: priv-lvl=10