Új hozzászólás Aktív témák

• #8916 zsolti.22 senior tag zsolti.22 #8915

  Új Válasz 2015-07-10 23:25:42 #8916

  Új hozzászólás

  Összes hozzászólása itt Válaszok az összes hozzászólására itt Válaszok erre a hozzászólásra

  Privát üzenet küldése

  

  zsolti.22

  senior tag

  válasz zsolti.22 #8915 üzenetére

  Rájöttem.
  Ha esetleg érdekel valakit:

  Kiinduló konfiguráció, melyből csak az aaa-releváns konfigot másoltam ki:

  ciscoasa# sh run | i TAC|key
  aaa-server TAC protocol tacacs+
  aaa-server TAC (inside) host 172.16.0.2
  key *****
  aaa authentication telnet console TAC
  aaa authentication ssh console TAC
  aaa authentication serial console TAC
  aaa accounting command privilege 15 TAC
  aaa accounting serial console TAC
  aaa accounting ssh console TAC
  aaa accounting telnet console TAC
  aaa accounting enable console TAC

  A tacacs+ szerver nem Cisco ACS, hanem mezei TACACS.NET szerver, ami jól van beállítva.

  Logolást bekapcsoltam, merthogy alapból az sincs nemhogy konzolra, hanem sehogy, szóval kell egy logging enable és egy logging console 7, ami ezt dobja, ha be akarok lépni az ASA-ba:

  Username: zsolti.22
  Password: *****
  %ASA-7-609001: Built local-host identity:172.16.0.1
  %ASA-7-609001: Built local-host inside:172.16.0.2
  %ASA-6-302013: Built outbound TCP connection 98 for inside:172.16.0.2/49 (172.16.0.2/49) to identity:172.16.0.1/46606 (172.16.0.1/46606)
  %ASA-7-710005: UDP request discarded from 172.16.0.2/137 to inside:172.16.0.1/137
  %ASA-6-113004: AAA user authentication Successful : server = 172.16.0.2 : user = zsolti.22
  %ASA-6-113008: AAA transaction status ACCEPT : user = zsolti.22
  Type help or '?' for a list of available commands.
  %ASA-6-611101: User authentication succeeded: Uname: zsolti.22
  %ASA-6-605005: Login permitted from serial to console for user "zsolti.22"
  ciscoasa> %ASA-6-302013: Built outbound TCP connection 99 for inside:172.16.0.2/49 (172.16.0.2/49) to identity:172.16.0.1/25556 (172.16.0.1/25556)
  %ASA-6-113004: AAA user accounting Successful : server = 172.16.0.2 : user = zsolti.22
  %ASA-6-302014: Teardown TCP connection 98 for inside:172.16.0.2/49 to identity:172.16.0.1/46606 duration 0:00:00 bytes 60 TCP FINs
  %ASA-6-302014: Teardown TCP connection 99 for inside:172.16.0.2/49 to identity:172.16.0.1/25556 duration 0:00:00 bytes 106 TCP FINs
  %ASA-7-609002: Teardown local-host identity:172.16.0.1 duration 0:00:00
  %ASA-7-609002: Teardown local-host inside:172.16.0.2 duration 0:00:00

  {és itt lesz a lúdas}:

  ciscoasa> ena
  Password: *****
  ciscoasa# %ASA-5-502103: User priv level changed: Uname: enable_15 From: 1 To: 15
  %ASA-5-111008: User 'zsolti.22' executed the 'enable' command.
  %ASA-7-609001: Built local-host identity:172.16.0.1
  %ASA-7-609001: Built local-host inside:172.16.0.2
  %ASA-6-302013: Built outbound TCP connection 109 for inside:172.16.0.2/49 (172.16.0.2/49) to identity:172.16.0.1/18492 (172.16.0.1/18492)
  %ASA-6-113004: AAA user accounting Successful : server = 172.16.0.2 : user = enable_15
  %ASA-6-302014: Teardown TCP connection 109 for inside:172.16.0.2/49 to identity:172.16.0.1/18492 duration 0:00:00 bytes 105 TCP FINs
  %ASA-7-609002: Teardown local-host identity:172.16.0.1 duration 0:00:00
  %ASA-7-609002: Teardown local-host inside:172.16.0.2 duration 0:00:00

  Ha így adok ki egy aaa authorization commands TAC-et, akkor minden parancsomat elutasítja a TAC, mivel nincs beállítva enable_15 userem az authentication/authorization fájlokban.

  Hozzáadtam a konfighoz ezt a sort:
  aaa authentication enable console TAC, ami azt csinálja, hogy a tacacs+-tól kér saját enable jelszót, nem pedig az asa-n lévő local enable jelszót kéri be:

  ciscoasa(config)# aaa authentication enable console TAC

  Kilépés, majd belépés:

  Username: zsolti.22
  Password: *****
  %ASA-7-609001: Built local-host identity:172.16.0.1
  %ASA-7-609001: Built local-host inside:172.16.0.2
  %ASA-6-302013: Built outbound TCP connection 115 for inside:172.16.0.2/49 (172.16.0.2/49) to identity:172.16.0.1/35451 (172.16.0.1/35451)
  %ASA-6-113004: AAA user authentication Successful : server = 172.16.0.2 : user = zsolti.22
  %ASA-6-113008: AAA transaction status ACCEPT : user = zsolti.22
  %ASA-6-611101: User authentication succeeded: Uname: zsolti.22
  %ASA-6-605005: Login permitted from serial to console for user "zsolti.22"
  Type help or '?' for a list of available commands.
  ciscoasa> %ASA-6-302013: Built outbound TCP connection 116 for inside:172.16.0.2/49 (172.16.0.2/49) to identity:172.16.0.1/60041 (172.16.0.1/60041)

  ciscoasa> ena
  Password: *
  %ASA-7-609001: Built local-host identity:172.16.0.1
  %ASA-7-609001: Built local-host inside:172.16.0.2
  %ASA-6-302013: Built outbound TCP connection 117 for inside:172.16.0.2/49 (172.16.0.2/49) to identity:172.16.0.1/47624 (172.16.0.1/47624)
  %ASA-7-710005: UDP request discarded from 172.16.0.2/137 to inside:172.16.0.1/137
  %ASA-6-113005: AAA user authentication Rejected : reason = Unspecified : server = 172.16.0.2 : user = zsolti.22
  Password: %ASA-6-611102: User authentication failed: Uname: zsolti.22
  %ASA-6-302014: Teardown TCP connection 117 for inside:172.16.0.2/49 to identity:172.16.0.1/47624 duration 0:00:00 bytes 56 TCP FINs
  %ASA-7-609002: Teardown local-host identity:172.16.0.1 duration 0:00:00
  %ASA-7-609002: Teardown local-host inside:172.16.0.2 duration 0:00:00
  ******
  %ASA-7-710005: UDP request discarded from 172.16.0.2/137 to inside:172.16.0.1/137
  %ASA-6-113004: AAA user authentication Successful : server = 172.16.0.2 : user = zsolti.22
  %ASA-6-113008: AAA transaction status ACCEPT : user = zsolti.22
  ciscoasa# %ASA-6-611101: User authentication succeeded: Uname: zsolti.22
  %ASA-5-502103: User priv level changed: Uname: zsolti.22 From: 1 To: 15
  %ASA-5-111008: User 'zsolti.22' executed the 'enable' command.
  %ASA-6-302013: Built outbound TCP connection 122 for inside:172.16.0.2/49 (172.16.0.2/49) to identity:172.16.0.1/34844 (172.16.0.1/34844)
  %ASA-6-113004: AAA user accounting Successful : server = 172.16.0.2 : user = zsolti.22
  %ASA-6-302014: Teardown TCP connection 121 for inside:172.16.0.2/49 to identity:172.16.0.1/9421 duration 0:00:08 bytes 61 TCP FINs
  %ASA-6-302014: Teardown TCP connection 122 for inside:172.16.0.2/49 to identity:172.16.0.1/34844 duration 0:00:00 bytes 105 TCP FINs

  Így már zsolti.22 néven vagyok enable módban és ha így akarok játszadozni az authorizációval, akkor prímán működik is
  Szóval ha nem a tacacs+-tól kérem az enable jelszót, akkor enable_15 userként leszek bent enable módban...

Új hozzászólás Aktív témák