Tacacs with Zyxel

[thegoggel]

Hi

I'm having issues having Zyxel devices using Tacacs. When authenticationg it works fine, but when I'm trying to go into enable mode I get access denied. In the debug log I get "enable 14 for '$enab14$' from async on tty0 failed (This might be a bug, consider reporting it!)"
So for some reason it sends me the username $enab14$. I can see in the manual that I can add augmented-enable = permit under host to bypass this but it does not help.

In the documentation for Zyxel it's said that you should create users with the username $enab14$, $enab2$, $enab7$ etc.

Is there any way of using the user I'm logged in to authenticate with on enable mode.

I also only get read access on web for some strange reason.

[MarcJHuber]

Hi,

could you share debug output?

Thanks,

Marc

[thegoggel]

10: 10:13:58.969 f/efaf0cef: 172.16.68.40 New session
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 ------
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 key used: secretkey
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 version: 192, type: 1, seq no: 1, flags: unencrypted
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 session id: ef0cafef, data length: 25
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 packet body (len: 25): \001\016\001\002\b\004\005\000$enab14$tty0async
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 0000 01 0e 01 02 08 04 05 00 24 65 6e 61 62 31 34 24 ........ $enab14$
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 0010 74 74 79 30 61 73 79 6e 63 tty0asyn c
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 AUTHEN/START, priv_lvl=14
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 action=login (1)
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 authen_type=ascii (1)
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 service=enable (2)
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 user_len=8 port_len=4 rem_addr_len=5
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 data_len=0
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 user (len: 8): $enab14$
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 0000 24 65 6e 61 62 31 34 24 $enab14$
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 port (len: 4): tty0
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 0000 74 74 79 30 tty0
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 rem_addr (len: 5): async
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 0000 61 73 79 6e 63 async
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 ------
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 authen: hdr->seq_no: 1
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 looking for user $enab14$ realm default
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 user lookup failed
10: 10:13:58.969 f/efaf0cef: 172.16.68.40 looking for user $enab14$ in MAVIS backend
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 verdict for user $enab14$ is NFD
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 looking for user $enab14$ realm default
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 user lookup failed
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 Writing AUTHEN/GETPASS size=28
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 ------
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 key used: secretkey
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 version: 192, type: 1, seq no: 2, flags: unencrypted
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 session id: ef0cafef, data length: 16
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 packet body (len: 16): \005\001\000\n\000\000Password:
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 0000 05 01 00 0a 00 00 50 61 73 73 77 6f 72 64 3a 20 ......Pa ssword:
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 AUTHEN, status=5 (AUTHEN/GETPASS) flags=0x1
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 msg_len=10, data_len=0
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 msg (len: 10): Password:
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 0000 50 61 73 73 77 6f 72 64 3a 20 Password :
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 data (len: 0):
10: 10:13:58.977 f/efaf0cef: 172.16.68.40 ------
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 ------
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 key used: secretkey
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 version: 192, type: 1, seq no: 3, flags: unencrypted
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 session id: ef0cafef, data length: 18
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 packet body [partially masked] (len: 18): \000\r\000\000\000*************
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 0000 00 0d 00 00 00 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a .....*** ********
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 0010 2a 2a **
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 AUTHEN/CONT user_msg_len=13, user_data_len=0
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 ------
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 authen: hdr->seq_no: 3
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 looking for user $enab14$ realm default
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 user lookup failed
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 enable 14 for '$enab14$' from async on tty0 failed (This might be a bug, consider reporting it!)
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 Writing AUTHEN/FAIL size=36
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 ------
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 key used: secretkey
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 version: 192, type: 1, seq no: 4, flags: unencrypted
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 session id: ef0cafef, data length: 24
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 packet body (len: 24): \002\000\000\022\000\000Permission denied.
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 0000 02 00 00 12 00 00 50 65 72 6d 69 73 73 69 6f 6e ......Pe rmission
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 0010 20 64 65 6e 69 65 64 2e denied.
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 AUTHEN, status=2 (AUTHEN/FAIL) flags=0x0
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 msg_len=18, data_len=0
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 msg (len: 18): Permission denied.
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 0000 50 65 72 6d 69 73 73 69 6f 6e 20 64 65 6e 69 65 Permissi on denie
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 0010 64 2e d.
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 data (len: 0):
10: 10:13:58.981 f/efaf0cef: 172.16.68.40 ------

[thegoggel]

Hi
I was able to resolve the issue with configuration on the Zyxel router. So I got it to work now :)

[MarcJHuber]

Hi,

thanks, but that was indeed an issue with tac_plus-ng: The ACL used internally to check for the $enable..$ user wasn't set. Fixed now, augmented enable should work again, thanks for reporting!

Cheers,

Marc