search

kravietz / pam_tacplus

TACACS+ protocol client library and PAM module in C. This PAM module support authentication, authorization (account management) and accounting (session management)performed using TACACS+ protocol designed by Cisco.
GNU Lesser General Public License v3.0
132 stars 102 forks source link

pam_tacplus(ver 1.5.1) IPv6 - Password is always set as "INCORRECT" for non-local user #157

Closed rajeevghosh2000 closed 3 years ago

rajeevghosh2000 commented 4 years ago

I installed pam_tacplus ver 1.5.1 and configured TACACS Client to send request to TACACS server in IPv6 . But when a local user(present in /etc/passwd) logs in, I can see in TACACS Authentication request , Password field is same as the user typed. whereas if the user is non-local user then , in TACACS Authentication , Password is always "\b\n\r\177INCORRECT\b\n\r" irrespective of what the user types in

Following is /etc/nsswitch.conf: passwd: files tacplus [NOTFOUND=return] db shadow: files tacplus [NOTFOUND=return] db group: files tacplus [NOTFOUND=return] db

Pkg information: pam_tacplus-1.5.1-1.x86_64 nss_tacplus-2.0-1.x86_64

Please help on this

akhileshsingh-saithwar commented 4 years ago

I installed pam_tacplus ver 1.5.1 and configured TACACS Client to send request to TACACS server in IPv6 . But when a local user(present in /etc/passwd) logs in, I can see in TACACS Authentication request , Password field is same as the user typed. whereas if the user is non-local user then , in TACACS Authentication , Password is always "\b\n\r\177INCORRECT\b\n\r" irrespective of what the user types in

Following is /etc/nsswitch.conf: passwd: files tacplus [NOTFOUND=return] db shadow: files tacplus [NOTFOUND=return] db group: files tacplus [NOTFOUND=return] db

Pkg information: pam_tacplus-1.5.1-1.x86_64 nss_tacplus-2.0-1.x86_64

Please help on this

Hi Rajeev,

I was also facing the similar issue for remote user. Here is the work around "https://github.com/donapieppo/libnss-ato".

kravietz commented 3 years ago

Seems to be NSS not pam_tacplus issue