Re: AAA allowing local authentication with TACACS+ configured.

Turns out for some reason, although it succesfully logging in users,
FAILs were timing when communicating with ACS. I noticed this by
turning tacacs debugging on.


Bumping the time-out value to 10 seconds took care of it. Our ACS
servers may need a good kick.

However, couldn't this be used for a timing attack to harvest accounts?

Merv wrote:
Mike wrote:
I was under the impression:

aaa authentication login default group tacacs+ local

Means TACACS+ is up and happy, use that. If TACACS+ returns ERROR, use
local credentials. This is good.

However, I figures this also meant deny local authentication if TACACS+
is up and functioning. But I can still login using local credentials
even when TACACS+ is up and functioning. Is there a way I can disable
this?

If authentication fails against the TACACS database no futher AAA
method should be used. If it is being used then it is a bug.

"A FAIL response is significantly different from an ERROR. A FAIL means
that the user has not met the criteria contained in the applicable
authentication database to be successfully authenticated.
Authentication ends with a FAIL response. An ERROR means that the
security server has not responded to an authentication query. Because
of this, no authentication has been attempted. Only when an ERROR is
detected will AAA select the next authentication method defined in the
authentication method list."

.

Relevant Pages

  • Re: AAA allowing local authentication with TACACS+ configured.
    ... Means TACACS+ is up and happy, ... I figures this also meant deny local authentication if TACACS+ ... But I can still login using local credentials ... "A FAIL response is significantly different from an ERROR. ...
    (comp.dcom.sys.cisco)
  • [NEWS] TACACS+ Authentication Bypass in Cisco Anomaly Detection and Mitigation Products
    ... TACACS+ Authentication Bypass in Cisco Anomaly Detection and Mitigation ... The aaa authentication login tacacs+ command configures TACACS+ ...
    (Securiteam)
  • CiscoSecure ACS v. 3.3 user TACACS+ password choice defaults not LDAP
    ... I have a CiscoSecure ACS v.3.3 that is configured to use MS AD LDAP ... for authentication for users. ... For each user, on the ACS, in the Advance TACACS+ Settings section, ... AD group RouterAdmin is mapped to RouterAdmin ...
    (comp.dcom.sys.cisco)
  • Re: tacacs and 2950
    ... I tried this today with the NON working account and it signed on fine. ... >I cannot get the tacacs authentication to work on our 2950's. ... > aaa authentication login MYGROUP group tacacs+ local line enable ...
    (comp.dcom.sys.cisco)
  • Re: Tacacs and OpenSSH
    ... The problem is, TACACS is an authentication protocol, not ... the user information needs to be able to be looked up at anytime. ... You must need a local account even though the authentication is ...
    (SSH)