Configuring TACACS+ authentication

This topic describes how to configure a TACACS+ server to return Local-User attributes, and to enable an appliance to authenticate with a TACACS+ server.

Configuring a TACACS+ server

Use the commands in this section to configure a TACACS+ server.

Note

Your TACACS+ server configuration should follow standard TACACS+ protocol. The examples in this topic are provided for illustration only.

To configure a TACACS+ server:

Define users on the authentication server.
In the tac_plus.conf file on the authentication server, configure a secret key. The same key must be configured on both the server and the appliance.
Store the file, typically in the /usr/local/etc/ directory.
Create user authentications against the TACACS+ server login credentials:
```
user=t-admin {
     pap = cleartext “test123” 
     service = fireeye-exec { 
     "local-user-name-fireeye” = “admin” 
  } 
}
 
user=t-monitor { 
     pap = cleartext “test123”
     service = fireeye-exec {
     “local-user-name-fireeye” = “monitor” 
  } 
} 
```
where local-user-name-fireeye is the mapping attribute that matches the Trellix code, and fireeye-exec matches the service definition. The t-admin user maps to the appliance admin role, and the t-monitor user maps to the appliance monitor role.
After configuring authentication mappings, put the following line in the /etc/rc.local file to start the authentication mapping on reboot:
```
/usr/local/bin/tac_plug -g -C /usr/local/etc/tac_plus.conf
```

Enabling an appliance to authenticate with a TACACS+ server

Use the commands in this section to enable an appliance to authenticate with a TACACS+ server.

Important

You can configure multiple TACACS+ servers on an appliance. The appliance will contact the servers in the order in which they were configured. If the first server in the list is unreachable, the appliance will contact the next server, and so on.

Note

You can configure some TACACS+ settings globally, so the settings apply to all TACACS+ servers configured on an appliance and become the new default settings. For example, you could use the tacacs-server timeout <seconds> command to configure the timeout value for all TACACS+ servers.

To enable TACACS+ authentication:

Define the server host and server key attributes:
```
hostname <config> # tacacs-server host <ip address> key <key string>
```
where ip address is the IPv4 address of the TACACS+ server and key string is the secret key configured on the TACACS+ server.
By default, the appliance retransmits a request that previously timed out after three seconds. To change the number of seconds:
```
hostname (config) # tacacs-server host <ip address> timeout <seconds>
```
where seconds can be 1–60.
By default, the appliance attempts to contact the TACACS+ server one time before the request fails. To change the number of attempts:
```
hostname (config) # tacacs-server host <ip address> retransmit <number>
```
where number can be 0–5.
By default, the port number for TACACS+ authentication is 49. To change the port number:
```
hostname (config) # tacacs-server host <ip address> auth-port <port number>
```
By default, PAP is the TACACS+ authentication type. To change the authentication type:
```
hostname (config) # tacacs-server host <ip address> auth-type <type>
```
where type is ascii or pap.
Add TACACS+ authentication to the authentication method list in the desired order. For example:
```
hostname (config) # aaa authentication login default local tacacs+
```
Verify your changes:
```
hostname (config) # show tacacs
```

Note

A TACACS+ server is administratively enabled by default. Use the tacacs-server host <ip address> enable command if you need to re-enable it.

See the CLI Command Reference for a complete list of TACACS+ server commands and parameters.

Note

To add multiple TACACS+ servers to an appliance, repeat the following commands with a different IP address for each TACACS+ server you want to add:

hostname (config) # tacacs-server host <IP address> key <key string>

hostname (config) # tacacs-server host <IP address> timeout <seconds>

hostname (config) # tacacs-server host <IP address> retransmit <number>

Example

The following example configures a TACACS+ server and changes the timeout and retransmit values.

hostname (config) # tacacs-server host 192.168.2.1 key 12345678
hostname (config) # tacacs-server host 192.168.2.1 timeout 5
hostname (config) # tacacs-server host 102.168.2.1 retransmit 2
hostname (config) # aaa authentication login default local tacacs+
hostname (config) # show tacacs
TACACS+ Settings:
    Authentication and Authorization are enabled in AAA configuration.
    Accounting is disabled in AAA configuration.

TACACS+ DEFAULTS:
    Key:               ********
    Timeout:           3
    Retransmit:        1
TACACS+ servers:
   192.168.2.1:49
      Enabled:          yes
      Auth Type:        pap
      Key:              *********
      Timeout:          5
      Retransmit:       2