tac_plus-ng logging format

[sea2space]

Hello!

I have small configuration tac_plus-ng, users are taken from AD using mavis module. Everything works.

A few questions:

1. How can I stop and start tac_plus-ng?
2. How to customize log format? For example, add a unique ID at the beginning?
   Right now everything is in default form:

2025-02-05 11:57:56 +0300 10.250.24.198 testuser ssh 10.XXX.XXX.XXX.XXX stop shell show clock

In the guide I found "accounting, authorization, access log format", but I don't understand how to customize it in the configuration file.

My config:

#!/usr/local/sbin/tac_plus-ng
id = spawnd {
    listen = { address = 0.0.0.0 port = 49 }
        spawn = {
                instances min = 1
                instances max = 10
        }
        background = yes
}

id = tac_plus-ng {
    connection timeout = 600
    retire limit = 10
    log authzlog { destination = /var/log/tac_plus/%Y/%m/%d/authz.log }
    log authclog { destination = /var/log/tac_plus/%Y/%m/%d/authc.log }
    log acctlog  { destination = /var/log/tac_plus/%Y/%m/%d/acct.log }
    accounting log = acctlog
    authentication log = authclog
    authorization log = authzlog

    user backend = mavis
    pap backend = mavis
    login backend = mavis chpass

    mavis module = groups {
        resolve gids = yes
        resolve gids attribute = TACMEMBER
        groups filter = "(AdminTSPD)"
    }

    mavis module = external {
                setenv LDAP_SERVER_TYPE = "microsoft"
                setenv LDAP_HOSTS = "XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX"
                setenv LDAP_SCOPE = sub
                setenv LDAP_BASE = "dc=XXX,dc=XXX,dc=XXX"
                setenv LDAP_FILTER = "(&(objectclass=user)(sAMAccountName=%s))"
                setenv LDAP_USER = "[email protected]"
                setenv LDAP_PASSWD = "password123"
                setenv USE_TLS = 0
                setenv UNLIMIT_AD_GROUP_MEMBERSHIP = 1
                setenv EXPAND_AD_GROUP_MEMBERSHIP = 0
                setenv AD_GROUP_PREFIX = ""
                setenv REQUIRE_TACACS_GROUP_PREFIX = 0
                exec = /usr/local/lib/mavis/mavis_tacplus-ng_ldap.pl
     }

    host TEST {
        connection timeout = 600
        address = 10.XXX.XXX.XXX/16
            key = "XXXXXX"

    profile netadmin {
        script {
            if (service == shell) {
                    if (cmd == "") {
                        set priv-lvl = 15
                        permit
                }
            }
        }
    }

group AdminTSPD

    user admintech {
        password login = crypt $1$rXDhcIlU$XMd4RfE98HtkIIFxcEMlR/
        member = AdminTSPD
    }

    ruleset {
        rule {
            script {
                if (member == AdminTSPD) { profile = netadmin permit }
            }
        }
    }
}

[MarcJHuber]

Hi,

tac_plus-ng/extra/ comes with etc_init.d_tac_plus-ng and tac_plus-ng.service, one of those two can likely be adapted to your system for starting and stopping the daemon.

Regarding logging, you've seen the samples included here?

Cheers,

Marc

[sea2space]

@MarcJHuber Thx!

tac_plus-ng/extra/ comes with etc_init.d_tac_plus-ng and tac_plus-ng.service, one of those two can likely be adapted to your system for starting and stopping the daemon.

I use tac_plus-ng.service. It works, great!

Regarding logging, you've seen the samples included here?

Yeah, I got it. Using example, made this config:

log cmdlog {
        destination = "/var/log/tac_plus/%Y/%m/%d/tac_plus-ng.log"
        access format = "%Y-%m-%d %H:%M:%S\t${log-sequence}${session.id}\tdevice_ip:\t${nas}\t${port}_user:\t${user}\tuser_ip:\t${nac}\taccess:\t${action} ${hint}\n"
        authorization format = "%Y-%m-%d %H:%M:%S\t${log-sequence}${session.id}\tdevice_ip:\t${nas}\t${port}_user:\t${user}\tuser_ip:\t${nac}\tauth:\t${profile} ${result} ${service}\n"
        accounting format = "%Y-%m-%d %H:%M:%S\t${log-sequence}${session.id}\tdevice_ip:\t${nas}\t${port}_user:\t${user}\tuser_ip:\t${nac}\tcmd:\t${cmd} \n"
}

accounting log = cmdlog
authentication log = cmdlog
authorization log = cmdlog

Now I get messages like this
2025-02-06 11:32:43 6208d5ba27 device_ip: 10.XX.XX.XX vty0_user: testuser user_ip: 10.XX.XX.XX cmd: quit

The only thing is by default I had 3 log files (authz, authc, acct). Now all events are recorded in one file (tac_plus-ng.log).
I thought I could make three log {} sections for authz, authc, acct respectively, but it doesn't work that way.

[sea2space]

Another question:

Can i send logs to two destinations?
For example
1 locally to disk
2 to a remote syslog server

[MarcJHuber]

Hi,

your can separate logs by specifying suitable accounting/access/authorization destinations. The "destination" definition defines where the log files will end up to.

log log_a { destination = /tmp/c access format = ... }
log log_b { destination = /tmp/b accounting format = ...}
log log_c { destination = /tmp/c ...}

combined with

authentication log = log_a
accounting log = log b
...

will cleanly separate logs.

About your second question: yes, adding multiple "a... log = ..." statements is certainly possible, so you can e.g. log to both file and syslog.

Cheers,

Marc

[sea2space]

@MarcJHuber Thx!

1. Followed your recommendations, everything worked!
   Logs is separate!

My config

    log  cmdlog_access {
            destination = "/var/log/tac_plus-ng/tac_plus-access.log"             
            access format = "my log format"
    }
    
            log cmdlog_authorization {
            destination = "/var/log/tac_plus-ng/tac_plus-authorization.log"
            authorization format = "my log format"
    }
    
            log cmdlog_accounting {
            destination = "/var/log/tac_plus-ng/tac_plus-accounting.log"
            accounting format = "my log format"
    }
    

    accounting log = cmdlog_accounting
    authentication log = cmdlog_access
    authorization log = cmdlog_authorization

2. I test config two destination:

log cmdlog_authorization {
...
destination = "/var/log/tac_plus-ng/tac_plus-authorization.log"
destination = syslog
...
}

but log writes only in syslog (local file is empty):

[root@aaantp1 ~]# tail -f /var/log/messages
Feb  7 08:53:35 10.XX.XX.XX tac_plus-ng[20452]: 10.XX.XX.XX|testuser|ssh|10.XX.XX.XX|stop|shell|login
Feb  7 08:53:47 10.XX.XX.XX tac_plus-ng[20452]: 10.XX.XX.XX|testuser|ssh|10.XX.XX.XX|stop|shell|sh log

or i'm doing something wrong?

[MarcJHuber]

Hi,

you'll need to use two log definitions for that:

log cmdlog_authorization_disk {
    destination = "/var/log/tac_plus-ng/tac_plus-authorization.log"
}

log cmdlog_authorization_syslog {
    destination = syslog
}

authorization log = cmdlog_authorization_disk
authorization log = cmdlog_authorization_syslog

Cheers,

Marc

[sea2space]

@MarcJHuber Thanks for your help!

Got it, worked!