tac_plus-ng cache issue #147
Unanswered
OlexanderH
asked this question in
Q&A
Replies: 6 comments 4 replies
-
|
Hi, session->ctx basically references a single TACACS+ TCP connection from a device, so session->ctx->user_profile_cache is only valid for that particular device. (Side note: it requires single-connection to be enabled on both server and device.) The per-ctx-cache is purely local to the connection, there's no chance for a mix-up between devices. Cheers, Marc |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
Yes, I use no single-connection, not all vendors supports this feature. Unfortunately I was able to catch such a situation when command authorization was mixed-up between devices from cache. |
Beta Was this translation helpful? Give feedback.
-
|
Hi, ok, that's weird. Any way to reproduce this? I currently don't see where I could have messed up that. Relevant functions would be config.c:cache_user_profile() and config.c:lookup_user_profile(), and both are per-connection and take user name (ore, more exactly, the internal user struct pointer) and client IP into account. Cheers, Marc |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Ok, I will try to make a process model tomorrow. So, could you please prompt what are the necessary data should I collect in order to get the whole picture and where to route it so that this discussion not to be fluded. I am not sure that I will be able to change c code. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Hi Olexander, you could enable ACL or REGEX debugging (
line in the debug logs. Also, for the initial (uncached) profile look out for
lines, these are the initial profile assignments.
I don't think this will actually flood this discussion, so let's just continue here. Cheers, Marc |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Hi Marc, User test connects first device cisco_router_reg1 1.1.10.4 with profile=cis_ro User test connects second device cisco_router_reg2 2.2.27.1 with profile=cis_admin Here the cache returns the profile:cis_admin from the second session to the first session |
Beta Was this translation helpful? Give feedback.
3 replies
-
|
I looked at the log, it seems that it's not the cache that returns the permission, but with the cache disabled this doesn't happen. |
Beta Was this translation helpful? Give feedback.
-
|
I also collected a log with the cache disabled, most likely we are talking about the Mavis cache. |
Beta Was this translation helpful? Give feedback.
-
|
indeed, with the cache setting |
Beta Was this translation helpful? Give feedback.
-
|
Hi, could you please repeat that test with both ACL and REGEX debugging enabled and share the corresponding ruleset part of your configuration? If you feel not safe about sharing that output in public please send it via personal mail to [email protected] This really doesn't look like a cross-connection issue, I'd rather think that some user attribute that's used in one of your conditions gets lost in the user caching process. Thanks, Marc |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Hi, Mark.
I already wrote once that the cache works suspiciously.
I finally found the time to study its operation in more detail.
Do I understand correctly that the cache size is for 8 users?
#define USER_PROFILE_CACHE_SIZE 8Do I understand correctly from this code that only the username is cached without being tied to the device?
The problem is that if one user has different accesses to different devices, the cache returns the same results to different devices, so the user can get permission where he is not allowed.
The workaround is to disable the cache at all, which is what I used:
In general, it would be better if the username was cached somehow like this:
[email protected]
But unfortunately, this now creates security problems.
Thank you for your package.
Beta Was this translation helpful? Give feedback.
All reactions