TACACS+ Authentication

This example configures system authentication through a TACACS+ server.

Junos OS supports configuring Juniper Networks TACACS+ vendor-specific attributes (VSAs) on the TACACS+ server. Table 1 lists the supported Juniper Networks VSAs.

Some of the attributes accept extended regular expressions, as defined in POSIX 1003.2. If the regular expression contains any spaces, operators, or wildcard characters, enclose it in quotation marks. For more information, see:

• Regular Expressions to Allow and Deny Operational Mode Commands, Configuration Statements, and Hierarchies

• Use Regular Expressions on a RADIUS or TACACS+ Server to Allow or Deny Commands

Table 1: Juniper Networks Vendor-Specific TACACS+ Attributes

Name	Description	Length	String
local-user-name	Indicates the name of the user template assigned to this user when the user logs in to a device.	≥3	One or more octets containing printable ASCII characters.
allow-commands	Contains an extended regular expression that enables the user to run commands in addition to those commands authorized by the user’s login class permission bits.	≥3	One or more octets containing printable ASCII characters, in the form of an extended regular expression.
allow-commands-regexps	Contains an extended regular expression that enables the user to run commands in addition to those commands authorized by the user’s login class permission bits.	≥3	One or more octets containing printable ASCII characters, in the form of an extended regular expression.
allow-configuration	Contains an extended regular expression that enables the user to view and modify configuration statements in addition to those statements authorized by the user’s login class permission bits.	≥3	One or more octets containing printable ASCII characters, in the form of an extended regular expression.
allow-configuration-regexps	Contains an extended regular expression that enables the user to view and modify configuration statements in addition to those statements authorized by the user’s login class permission bits.	≥3	One or more octets containing printable ASCII characters, in the form of an extended regular expression.
deny-commands	Contains an extended regular expression that denies the user permission to run commands authorized by the user’s login class permission bits.	≥3	One or more octets containing printable ASCII characters, in the form of an extended regular expression.
deny-commands-regexps	Contains an extended regular expression that denies the user permission to run commands authorized by the user’s login class permission bits.	≥3	One or more octets containing printable ASCII characters, in the form of an extended regular expression.
deny-configuration	Contains an extended regular expression that denies the user permission to view or modify configuration statements authorized by the user’s login class permission bits.	≥3	One or more octets containing printable ASCII characters, in the form of an extended regular expression.
deny-configuration-regexps	Contains an extended regular expression that denies the user permission to view or modify configuration statements authorized by the user’s login class permission bits.	≥3	One or more octets containing printable ASCII characters, in the form of an extended regular expression.
user-permissions	Contains information the server uses to specify user permissions. Note: When the TACACS+ server defines the user-permissions attribute to grant the maintenance permission or all permission to a user, the user’s list of group memberships does not automatically include the UNIX wheel group. Some operations such as running the su root command from a local shell require wheel group membership permissions. However, when the network device defines a local user account with the permissions maintenance or all, the user is automatically granted membership to the UNIX wheel group. Therefore, we recommend that you create a user template account with the required permissions and associate individual user accounts with the user template account.	≥3	One or more octets containing printable ASCII characters. See Access Privilege Levels Overview.
authentication-type	Indicates the authentication method (local database or TACACS+ server) used to authenticate a user. If the user is authenticated using a local database, the attribute value shows 'local'. If the user is authenticated using a TACACS+ server, the attribute value shows 'remote'.	≥5	One or more octets containing printable ASCII characters.
session-port	Indicates the source port number of the established session.	size of integer	Integer

Junos OS can map RADIUS- and TACACS+-authenticated users to a locally defined user account or user template account, which defines the user's access privileges. You can also optionally configure a user's access privileges by defining Juniper Networks RADIUS and TACACS+ vendor-specific attributes (VSAs) on the respective authentication server.

A user's login class defines the set of permissions that determines which operational mode and configuration mode commands a user is authorized to execute and which areas of the configuration a user can view and modify. A login class can also define regular expressions that allow or deny a user the ability to execute certain commands or view and modify certain areas of the configuration, in addition to what the permission flags authorize. A login class can include the following statements to define user authorization:

• permissions

• allow-commands

• allow-commands-regexps

• allow-configuration

• allow-configuration-regexps

• deny-commands

• deny-commands-regexps

• deny-configuration

• deny-configuration-regexps

Similarly, a RADIUS or TACACS+ server configuration can use Juniper Networks VSAs to define specific permissions or regular expressions that determine a user's access privileges. For the list of supported RADIUS and TACACS+ VSAs, see the following:

• Juniper Networks Vendor-Specific RADIUS and LDAP Attributes
• Juniper Networks Vendor-Specific TACACS+ Attributes

You can define user permissions on the RADIUS or TACACS+ server as a list of space-separated values.

• A RADIUS server uses the following attribute and syntax:

  For example:

• A TACACS+ server uses the following attribute and syntax:

  For example:

A RADIUS or TACACS+ server can also define Juniper Networks VSAs that use a single extended regular expression (as defined in POSIX 1003.2) to allow or deny a user the ability to execute certain commands or view and modify areas of the configuration. You enclose multiple commands or configuration hierarchies in parentheses and separate them using a pipe symbol. If the regular expression contains any spaces, operators, or wildcard characters, enclose it in quotation marks. When you configure authorization parameters both locally and remotely, the device merges the regular expressions received during TACACS+ or RADIUS authorization with any regular expressions defined on the local device.

• A RADIUS server uses the following attributes and syntax:

  For example:

• A TACACS+ server uses the following attributes and syntax:

  For example:

RADIUS and TACACS+ servers also support configuring attributes that correspond to the same *-regexps statements that you can configure on the local device. The *-regexps TACACS+ attributes and the *-Regexps RADIUS attributes use the same regular expression syntax as the previous attributes, but they enable you to configure regular expressions with variables.

• A RADIUS server uses the following attributes and syntax:

• A TACACS+ server uses the following attributes and syntax:

  For example, the TACACS+ server configuration might define the following attributes:

On a RADIUS or TACACS+ server, you can also define the attributes using a simplified syntax where you specify each individual expression on a separate line.

For a RADIUS server, specify the individual regular expressions using the following syntax:

For a TACACS+ server, specify the individual regular expressions using the following syntax:

Note:

• In the TACACS+ server syntax, numeric values 1 through n must be unique but need not be sequential. For example, the following syntax is valid:

• The RADIUS or TACACS+ server imposes a limit on the number of individual regular expression lines.

• When you issue the show cli authorization command, the command output displays the regular expression in a single line, even if you specify each individual expression on a separate line.

Users can verify their class, permissions, and command and configuration authorization by issuing the show cli authorization operational mode command.

Note:

When you configure the authorization parameters both locally on the network device and remotely on the RADIUS or TACACS+ server, the device merges the regular expressions received during TACACS+ or RADIUS authorization with any locally configured regular expressions. If the final expression contains a syntax error, the overall result is an invalid regular expression.