Configuring TACACS+ - Cisco

1 Configuring TACACS+ FindingFeatureInformation,page 1 Prerequisitesfor TACACS+,page 1 InformationAbout TACACS+,page 3 How to ConfigureTACACS+,page 7 MonitoringTACACS+,page 16 AdditionalReferences,page 16 Finding Feature InformationYour softwarereleasemay not supportall the featuresdocumentedin this the latest caveatsandfeatureinformation,see Bug SearchTool and the releasenotes for your platformand informationabout the featuresdocumentedin this module,and to see a list of the releasesin which eachfeatureis supported,see the featureinformationtable at the end of this Cisco FeatureNavigatorto find informationabout platformsupportand Cisco softwareimage access Cisco FeatureNavigator, go to An accounton for TACACS+ The followingare the prerequisitesfor set up and configurationof switch access with TACACS+(must beperformedin the order presented):1 Configurethe switcheswith the TACACS+ server an key from Step 2 on the TACACS+ ,authorization,and accounting(AAA).

2 5 Create a login the list to the 2960-X Switch Series Configuration Guide, Cisco IOS Release (2)EX OL-29640-0117 Create an authorizationand followingare the prerequisitesfor controllingswitch access with TACACS+: YoumusthaveaccesstoaconfiguredTACACS+ser vertoconfigureTACACS+ , you must have access to TACACS+ servicesmaintainedin a databaseon a TACACS+ daemontypicallyrunningon a LINUXor Windowsworkstation. We recommenda redundantconnectionbetweena switch stack and the TACACS+ server. This is tohelp ensure that the TACACS+ server remainsaccessiblein case one of the connectedstack membersis removedfrom the switch stack.

3 You need a systemrunningthe TACACS+ daemonsoftwareto use TACACS+ on your switch. To use TACACS+,it must be enabled. Authorizationmust be enabledon the switch to be used. Users must first successfullycompleteTACACS+authenticatio nbefore proceedingto TACACS+ authorization. To use any of the AAA commandslisted in this sectionor elsewhere,you must first enable AAA withtheaaanew-modelcommand. At a minimum,you must identifythe host or hosts maintainingthe TACACS+ daemonand define themethodlists for TACACS+ can optionallydefine methodlists for TACACS+ authorizationand accounting.

4 The methodlist definesthe types of authenticationto be performedand the sequencein which they areperformed;it must be appliedto a specificport before any of the (which,bycoincidence,isnameddefault).The defaultmethodlist is automaticallyappliedto all ports except those that have a definedmethodlist overridesthe defaultmethodlist. Use TACACS+ for privilegedEXEC access authorizationif authenticationwas performedby usingTACACS+. Use the local databaseif authenticationwas not performedby using TACACS+.Related TopicsTACACS+Overview, on page 3 TACACS+ Operation, on page 5 How to ConfigureTACACS+, on page 7 MethodList, on page 6 ConfiguringTACACS+Login Authentication, on page 9 TACACS+ Login Authentication, on page 6 ConfiguringTACACS+Authorizationfor PrivilegedEXEC Accessand NetworkServices, on page 12 TACACS+ Authorizationfor PrivilegedEXEC Accessand NetworkServices, on page 6 Cisco 2960-X Switch Series Configuration Guide, Cisco IOS Release (2)

5 EX2OL-29640-01 Configuring TACACS+ Prerequisites for TACACS+ Information About TACACS+ TACACS+ and Switch AccessThis sectiondescribesTACACS+. TACACS+ providesd etailedaccountinginformationand ,authorization,accounting(AAA)and can be enabledonly throughAAA TopicsPreventingUnauthorizedAccessConfig uringthe Switchfor Local Authenticationand AuthorizationSSH Servers,IntegratedClients,and SupportedVersionsTACACS+ OverviewTACACS+is a securityapplicationthat providescentralizedvalidationof users attemptingto gain access toyour +providesforseparateandmodularauthentica tion,authorization, +allows for a single access controlserver (the TACACS+ daemon)

6 To provideeach service authentication,authorization,andaccounti ng other servicesavailableon that server or on the network,dependingon the capabilitiesof the 2960-X Switch Series Configuration Guide, Cisco IOS Release (2)EX OL-29640-013 Configuring TACACS+ Information About TACACS+ The goal of TACACS+ is to providea methodfor managingmultiplenetworkaccess points from a switch can be a networkaccess server along with other Cisco routersand 1: Typical TACACS+ Network ConfigurationTACACS+,administeredthrough the AAA securityservices,can providethese services: Authentication Providescompletecontrolofauthenticationt hroughloginandpassworddialog,challengean d response,and (forexample,afterausernameandpasswordare provided,to challengea user with severalquestions,such as home address,mother s maidenname,servicetype,andsocialsecurity number).

7 TheTACACS+ ,amessagecouldnotifyusersthattheirpasswo rdsmustbechangedbecauseof the company s passwordaging policy. Authorization Providesfine-grainedcontroloverusercapab ilitiesforthedurationoftheuser ssession,includingbutnotlimitedtosetting autocommands,accesscontrol,sessiondurati on, +authorizationfeature. Accounting Collectsand sends informationused for billing,auditing,and reportingto the TACACS+ use the accountingfacilityto track user activityfor a securityaudit orto provideinformationfor user identities,start and stop times,executedcommands(such as PPP), numberof packets,and numberof bytes.

8 Cisco 2960-X Switch Series Configuration Guide, Cisco IOS Release (2)EX4OL-29640-01 Configuring TACACS+ TACACS+ OverviewThe TACACS+ protocolprovidesauthenticationbet weenthe switch and the TACACS+ daemon,and itensuresconfidentialitybecauseall protocolexchangesbetweenthe switch and the TACACS+ TopicsPrerequisitesfor TACACS+, on page 1 TACACS+ OperationWhenauserattemptsasimpleASCII loginbyauthenticatingtoaswitchusingTACAC S+,thisprocessoccurs:1 When the connectionis established,the switch contactsthe TACACS+ daemonto obtain a usernamepromptto show to the user. The user enters a username,and the switch then contactsthe TACACS+ ,theuserentersa password,and the passwordis then sent to the TACACS+ +allowsadialogbetweenthedaemonandtheuser untilthedaemonreceivesenoughinformationt o authenticatethe user.

9 The daemonpromptsfor a usernameand passwordcombination,but can includeother items, such as the user s mother s switch eventuallyreceivesone of these responsesfrom the TACACS+ daemon: ACCEPT The user is authenticatedand servicecan begin. If the switch is configuredto requireauthorization,authorizationbegins at this time. REJECT The user is not user can be deniedaccess or is promptedto retry thelogin sequence,dependingon the TACACS+ daemon. ERROR An error occurredat some time during authenticationwith the daemonor in the networkconnectionbetweenthe daemonand the an ERROR responseis received,the switchtypicallytries to use an alternativemethodfor authenticatingthe user.

10 CONTINUE The user is promptedfor ,theuserundergoesanadditionalauthorizati onphaseifauthorizationhasbeenenabledon the must first successfullycompleteTACACS+authenticatio nbefore proceedingtoTACACS+ TACACS+ authorizationis required,the TACACS+ daemonis again contacted,and it returnsanACCEPTor an ACCEPT responseis returned,the responsecontainsdata in the form of attributesthat direct the EXEC or NETWORK sessionfor that user and the servicesthat the user can access: Telnet, SecureShell (SSH),rlogin, or privilegedEXEC services Connectionparameters,includingthe host or client IP address,access list, and user timeoutsRelated TopicsPrerequisitesfor TACACS+, on page 1 Cisco 2960-X Switch Series Configuration Guide, Cisco IOS Release (2)EX OL-29640-015 Configuring TACACS+ TACACS+ OperationMethod ListA methodlist definesthe sequenceand methodsto be used to authenticate,to authorize,or to keep accountson a user.