Table Of Contents
Configuring TACACS and Extended TACACS
TACACS and Extended TACACS Configuration Task List
Set TACACS Password Protection at the User Level
Disable Password Checking at the User Level
Set Optional Password Verification
Set TACACS Password Protection at the Privileged Level
Disable Password Checking at the Privileged Level
Set Notification of User Actions
Set Authentication of User Actions
Establish the TACACS Server Host
Enable the Extended TACACS Mode
Enable Extended TACACS for PPP Authentication
Enable Standard TACACS for ARA Authentication
Enable Extended TACACS for ARA Authentication
Enable TACACS to Use a Specific IP Address
Configuring TACACS and Extended TACACS
The Terminal Access Controller Access Control System (TACACS) provides a way to centrally validate users attempting to gain access to a router or access server. Basic Cisco TACACS support is modeled after the original Defense Data Network (DDN) application. TACACS services are maintained in a database on a TACACS server running, typically, on a UNIX workstation. You must have access to and must configure a TACACS server before configuring the TACACS features on your Cisco router.
Cisco implements TACACS in the Cisco IOS software to allow centralized control over access to routers and access servers. Authentication can also be provided for Cisco IOS administration tasks on the router and access server user interfaces. With TACACS enabled, the router or access server prompts for a username and password, then verifies the password with a TACACS server.
This chapter describes the TACACS and extended TACACS protocols and the various ways you can use them to secure access to your network.
Note
Both TACACS and extended TACACS are now deprecated by Cisco.
For a complete description of the TACACS and extended TACACS commands used in this chapter, refer to the "TACACS, Extended TACACS, and TACACS+ Commands" chapter in the Security Command Reference. To locate documentation of other commands that appear in this chapter, use the command reference master index or search online.
TACACS Protocol Description
Cisco IOS software currently supports three versions of the Terminal Access Controller Access Control System (TACACS) security protocol, each one of which is a separate and unique protocol:
•
•
•
This chapter discusses how to enable and configure TACACS and extended TACACS. For information about TACACS+, refer to the "Configuring TACACS+" chapter.
identifies Cisco IOS commands available to the different versions of TACACS.
TACACS and Extended TACACS Configuration Task List
You can establish TACACS-style password protection on both user and privileged levels of the system EXEC.
The following sections describe the features available with TACACS and extended TACACS. The extended TACACS software is available using the File Transfer Protocol (FTP)—see the README file in the ftp-eng.cisco.com directory.
Note
•
•
•
•
•
•
•
•
•
•
•
•
•
Note
For TACACS configuration examples, refer to the "TACACS Configuration Examples" section located at the end of the this chapter.
Set TACACS Password Protection at the User Level
To enable password checking at login, use the following command in line configuration mode:
Note
Disable Password Checking at the User Level
If a TACACS server does not respond to a login request, the Cisco IOS software denies the request by default. However, you can prevent that login failure in one of the following two ways:
•
•
To specify one of these features, use either of the following commands in global configuration mode:
tacacs-server last-resort password
Allow a user to access privileged EXEC mode.
tacacs-server last-resort succeed
Set last resort options for logins.
Set Optional Password Verification
You can specify that the first TACACS request to a TACACS server is made without password verification. To do so, use the following command in global configuration mode:
When the user enters the login name, the login request is transmitted with the name and a zero-length password. If accepted, the login procedure is completed. If the TACACS server refuses this request, the terminal server prompts for a password and tries again when the user supplies a password. The TACACS server must support authentication for users without passwords to make use of this feature. This feature supports all TACACS requests such as login, SLIP, and enable.
Set TACACS Password Protection at the Privileged Level
You can set the TACACS protocol to determine whether a user can access the privileged EXEC level. To do so, use the following command in global configuration mode:
enable use-tacacs
Set the TACACS-style user ID and password-checking mechanism at the privileged EXEC level.
When you set TACACS password protection at the privileged EXEC level, the EXEC enable command will ask for both a new username and a password. This information is then passed to the TACACS server for authentication. If you are using the extended TACACS, it also passes any existing UNIX user identification code to the server.
CautionIf you use the enable use-tacacs command, you must also specify tacacs-server authenticate enable; otherwise, you will be locked out.
Note
Disable Password Checking at the Privileged Level
You can specify a last resort if the TACACS servers used by the enable command do not respond. To invoke this "last resort" login feature, use either of the following commands in global configuration mode:
enable last-resort password
Allow user to enable by asking for the privileged EXEC-level password.
enable last-resort succeed
Allow user to enable without further questions.
Set Notification of User Actions
The tacacs-server notify command allows you to configure the TACACS server to send a message when a user does the following:
•
•
•
To specify that the TACACS server send notification, use the following command in global configuration mode:
tacacs-server notify {connection [always] | enable | logout [always] | slip [always]}
Set server notification of user actions.
The retransmission of the message is performed by a background process for up to five minutes. The terminal user, however, receives an immediate response, allowing access to the terminal.
The tacacs-server notify command is available only if you have set up an extended TACACS server using the latest Cisco extended TACACS server software, available via FTP. (See the README file in the ftp-eng.cisco.com directory.)
Set Authentication of User Actions
For a SLIP or PPP session, you can specify that if a user tries to start a session, the TACACS software requires a response (either from the TACACS server host or the router) indicating whether the user can start the session. You can specify that the TACACS software perform authentication even when a user is not logged in; you can also request that the TACACS software install access lists.
If a user issues the enable command, the TACACS software must respond indicating whether the user can give the command. You can also specify authentication when a user enters the enable command.
To configure any of these scenarios, use the following command in global configuration mode:
tacacs-server authenticate {connection[always] enable | slip [always] [access-lists]}
Set server authentication of user actions.
The tacacs-server authenticate command is available only when you have set up an extended TACACS server using the latest Cisco extended TACACS server software, which is available via FTP. (See the README file in the ftp.cisco.com directory).
Establish the TACACS Server Host
The tacacs-server host command allows you to specify the names of the IP host or hosts maintaining a TACACS server. Because the TACACS software searches for the hosts in the order specified, this feature can be useful for setting up a list of preferred servers.
With TACACS and extended TACACS, the tacacs-server retransmit command allows you to modify the number of times the system software searches the list of TACACS servers (from the default of two times) and the interval it waits for a reply (from the default of five seconds).
To define the number of times the Cisco IOS software searches the list of servers, and how long the server waits for a reply, use the following commands as needed for your system configuration in global configuration mode:
Set Limits on Login Attempts
The tacacs-server attempts command allows you to specify the number of login attempts that can be made on a line set up for TACACS. Use the following command in global configuration mode to limit login attempts:
tacacs-server attempts count
Control the number of login attempts that can be made on a line set for TACACS verification.
Enable the Extended TACACS Mode
While standard TACACS provides only username and password information, extended TACACS mode provides information about the terminal requests to help set up UNIX auditing trails and accounting files for tracking the use of protocol translators, access servers, and routers. The information includes responses from these network devices and validation of user requests.
An unsupported, extended TACACS server is available via FTP for UNIX users who want to create the auditing programs (see the README file in the ftp-eng.cisco.com directory).
To enable extended TACACS mode, use the following command in global configuration mode:
Note
Enable Extended TACACS for PPP Authentication
You can use extended TACACS for authentication within PPP sessions. To do so, use the following commands in interface configuration mode:
For more information on PPP, refer to the "Configuring Media-Independent PPP and Multilink PPP" chapter in the Dial Solutions Configuration Guide. For an example of enabling TACACS for PPP protocol authentication, see the "TACACS Configuration Examples" section at the end of this chapter.
Enable Standard TACACS for ARA Authentication
You can use the standard TACACS protocol for authentication within AppleTalk Remote Access (ARA) protocol sessions. To do so, use the following commands starting in line configuration mode:
The arap use-tacacs single-line command is useful when integrating TACACS with other authentication systems that require a clear text version of the user's password. Such systems include one-time passwords, token card systems, and others.
By using the optional during-login argument with the autoselect command, you can display the username or password prompt without pressing the Return key. While the username or password name is displayed, you can choose to answer these prompts or to start sending packets from an autoselected protocol.
The remote user logs in through ARA as follows:
Step 1
Step 2
For more information on the ARA protocol, refer to the "Configuring AppleTalk Remote Access" chapter in the Dial Solutions Configuration Guide. For examples of enabling TACACS for ARA protocol authentication, see the "TACACS Configuration Examples" section at the end of this chapter.
Enable Extended TACACS for ARA Authentication
You can use extended TACACS for authentication within AppleTalk Remote Access (ARA) protocol sessions. The extended TACACS server software is available via FTP (see the README file in the ftp.cisco.com directory).
Note
After installing an extended TACACS server with ARA support, use the following commands in line configuration mode on each line:
By using the optional during-login argument with the autoselect command, you can display the username or password prompt without pressing the Return key. While the Username or Password name is being presented, you can choose to answer these prompts, or to start sending packets from an autoselected protocol.
For more information on the ARA protocol, refer to the "Configuring AppleTalk Remote Access" chapter in the Dial Solutions Configuration Guide.
Enable TACACS to Use a Specific IP Address
You can designate a fixed source IP address for all outgoing TACACS packets. The feature enables TACACS to use the IP address of a specified interface for all outgoing TACACS packets. This is especially useful if the router has many interfaces, and you want to make sure that all TACACS packets from a particular router have the same IP address.
To enable TACACS to use the address of a specified interface for all outgoing TACACS packets, use the following command in configuration mode:
ip tacacs source-interface subinterface-name
Enable TACACS to use the IP address of a specified interface for all outgoing TACACS packets.
TACACS Configuration Examples
The following example shows TACACS enabled for PPP authentication:
int async 1ppp authentication chapppp use-tacacsThe following example shows TACACS enabled for ARA authentication:
line 3arap use-tacacsThe following example shows a complete TACACS configuration for the Cisco AS5200 using Cisco IOS Release 11.1:
version 11.1service udp-small-serversservice tcp-small-servers!hostname isdn-14!enable password ww!username cisco password labisdn switch-type primary-5ess!controller T1 1framing esfclock source line primarylinecode b8zspri-group timeslots 1-24!interface Loopback20no ip address!interface Ethernet0ip address 172.16.25.15 255.255.255.224!interface Serial0no ip addressshutdown!interface Serial1no ip addressshutdownno cdp enable!interface Serial1:23ip address 150.150.150.2 255.255.255.0no ip mroute-cacheencapsulation pppisdn incoming-voice modemno peer default ip address pooldialer idle-timeout 1dialer map ip 150.150.150.1 name isdn-5 broadcast 1234dialer-group 1no fair-queueppp multilinkppp authentication papppp pap sent-username isdn-14 password 7 05080F1C2243!interface Group-Async1ip unnumbered Ethernet0encapsulation pppasync mode interactivepeer default ip address pool defaultno cdp enableppp authentication chapppp use-tacacsgroup-range 1 24!ip local pool default 171.68.187.1 171.68.187.8no ip classlessip route 0.0.0.0 0.0.0.0 172.16.25.1ip route 192.100.0.12 255.255.255.255 Serial1:23tacacs-server host 171.68.186.35tacacs-server last-resort succeedtacacs-server extendedtacacs-server authenticate slip access-liststacacs-server notify connections alwaystacacs-server notify logout alwaystacacs-server notify slip always!dialer-list 1 protocol ip permit!line con 0line 1 24session-timeout 30 outputexec-timeout 1 0no activation-characterautoselect during-loginautoselect pppno vacant-messagemodem InOutmodem autoconfigure type microcom_hdmstransport input allspeed 115200line aux 0line vty 0 4password wwloginend
