User access to device

[sea2space]

Hello!

Is it possible in tac-plus_ng give a specific user access to only 1 network device?

(For example: user test is given full access only to the device 192.168.100.1)

[MarcJHuber]

Hi,

profile ACLs can be used to limit access. Example:

        user test {
                password login = clear test123
                password pap = login
                profile {
                        acl {
                                if (device.address != 192.168.100.1)
                                        deny
                                permit
                        }
                        script {
                                if (service == "shell") {
                                        if (cmd == "")
                                                set priv-lvl = 15
                                        permit
                                }
                        }
                }
        }

There are various other options that would work, too (e.g. comparing a device instead of an IP address).

Cheers,

Marc

[sea2space]

Hi,

profile ACLs can be used to limit access. Example:

        user test {

                password login = clear test123

                password pap = login

                profile {

                        acl {

                                if (device.address != 192.168.100.1)

                                        deny

                                permit

                        }

                        script {

                                if (service == "shell") {

                                        if (cmd == "")

                                                set priv-lvl = 15

                                        permit

                                }

                        }

                }

        }

There are various other options that would work, too (e.g. comparing a device instead of an IP address).

Cheers,

Marc

get error:

user test {
password login = clear test123
password pap = login
profile {
acl
tac_plus-ng.cfg:176: Expected 'debug', 'enable', 'hushlogin', 'profile', 'script', 'skip' or '}', but got 'acl'

[MarcJHuber]

Hi,

I've introduced that option in

commit c0a2483efd05b336a261f38ec46f8efb03825f4c
Author: Marc Huber <[email protected]>
Date:   Mon Mar 17 20:17:59 2025 +0100

    tac_plus-ng/config.c: add 'acl' script option to profiles. Currently undocumented.

Is your tree at current GIT commit level?

Cheers,

Marc

[sea2space]

Yeah, I didn't have the latest version
Now I copied the latest one.

Now when I check the configuration, everything is fine, thx!

4493: 09:50:37.068 0/00000000: - Version 138db65fa8593cdaf8efdf6012d52a26380a63cf initialized
4493: 09:50:43.826 0/7aed46c2: 10.20.42.193 authen: hdr->seq_no: 1
4493: 09:50:43.826 0/7aed46c2: 10.20.42.193 looking for user test realm default
4493: 09:50:43.826 0/7aed46c2: 10.20.42.193 user lookup succeded
4493: 09:50:45.714 0/7aed46c2: 10.20.42.193 authen: hdr->seq_no: 3
4493: 09:50:45.714 0/7aed46c2: 10.20.42.193 looking for user test realm default
4493: 09:50:45.714 0/7aed46c2: 10.20.42.193 user lookup succeded
4493: 09:50:45.714 0/7aed46c2: 10.20.42.193 shell login for 'test' from 10.250.29.138 on tty1 succeeded (profile=test)