Network Administration : Installation of Tacacs+, Rancid, Cvsweb

This article will describe you how to install a complete solution to manage users that have access to your network devices and also how to automatically backup your network devices configurations with a cvs based storage in order to have diffs on it. You'll also be able to script commands you want to run on your routers/switches to have easier administration.

Introduction

This document is in constant evolution, do not hesitate to check it sometimes. If you see something that have to be added/corrected, feel free to contact me.
Follow this document step by step and it will work without problems, do not jump a section, read it carrefully.

• Tacacs+ : is an authentication server that will allow you to manage users that have to access network devices and give them different access level (super user or mortal user). You also could have for each user a list of commands he can use.
• Rancid : is a tool which automatically backup your network devices configuration and store them in text and cvs format. It also allow you to script commands that have to be executed on your network devices using clogin described in this article. clogin is also used to automate the connection to the network devices
• Cvsweb : will display cvs stored configurations in a web page that will allow you to compare different versions of your configurations.

Note : This document has been written for cisco devices only using IOS software. It should work with other network devices vendor (such as Juniper, Foundry...) but you should read vendor's documentation and rancid one to see how to configure it properly. It also works with Cisco using catos software but no catos commands are provided in this document.

Installation

First of all you'll need to get the latest version of tacacs+ here : http://www.shrubbery.net/tac_plus

Note : Don't do an apt-get install tac-plus, it's the cisco version which should not work with the configuration file of this manual. The shrubbery version is also more updated.

This document has been written using tacacs+-F4.0.4.10.
You'll need to install the tcp wrappers and compilation tools if they're not yet installed.

# apt-get install libwrap0-dev gcc make libc6-dev

Once you've got the tacacs+ archive, you have to uncompress it (in /usr/src for example).
Before installing tacacs+ I kindly advise you to read the INSTALL file in the tacacs+ uncompressed directory if you want more informations.

# cp tacacs+-F4.0.4.10.tar.gz /usr/src
# cd /usr/src
# tar xvfz tacacs+-F4.0.4.10.tar.gz
# cd tacacs+-F4.0.4.10
# ./configure
# make install

Installation directories are the following :
/usr/local/bin : for the binaries tac_plus and tac_pwd
/usr/local/man : for the manuals
man tac_plus and man tac_pwd are now available for more informations.

Now we have to create the tacacs configuration file : /etc/tac_plus.conf

#
# tacacs configuration file
# Pierre-Yves Maunier - 20060713
# /etc/tac_plus.conf

# set the key
key = cle_tacacs

accounting file = /var/log/tac_plus.acct

# users accounts
user = tifrere {
        login = cleartext "normal"
        enable = cleartext "enable"
        name = "Pierre-Yves Maunier"
}

For the moment you have an user called "tifrere". His password to get connected on the device is "normal" and the password to get in priviliged mode is "enable".
As his passwords are in clear text, it should be safe to encrypt them, so we use the tool tac_pwd.

# tac_pwd
Password to be encrypted: normal
yrVMIa532Sy.2
# tac_pwd
Password to be encrypted: enable
Elwo6gXCbVulw

So we change tifrere's account like this :

user = tifrere {
        login = des "yrVMIa532Sy.2"
        enable = des "Elwo6gXCbVulw"
        name = "Pierre-Yves Maunier"
}

For more security, we change the permissions of the configuration file :

# chmod 600 /etc/tac_plus.conf

Now we have to configure the cisco device in order for it to look for users in the tacacs+ server.

Note : We will create a local user on the cisco device which be usable only if the tacacs server is unreachable. This user account will be disabled when the tacacs server is reachable.

In this example, the local user account will be :
username : local_user
password : local_password
enable : local_secret

aaa new-model
aaa authentication login telnet group tacacs+ local
aaa authentication login console group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization exec default if-authenticated none
aaa accounting update newinfo
aaa accounting exec default start-stop group tacacs+
!
enable secret local_secret
!
username local_user secret local_password
!
line con 0
login authentication console
line vty 0 4
login authentication telnet
line vty 5 15
!
tacacs-server host 192.168.10.64
tacacs-server key cle_tacacs

Note : 192.168.10.64 is the ip address of the tacacs+ server

---------- Explainations ----------

Router(config)# aaa authentication login {default | list-name} method1
[method2...]

list-name is a char string used to give a name to the authentication list. The argument method allow to list the authentication methods that have to be used ('group tacacs+' and 'local' here). The first method will always be used and the second one will be used only if the first method return an error, not if the authentication fails : usefull when you want to have the local authentication only if the tacacs+ server is unreachable.
If we use default instead of an named list, the default authentication list will be used for all 'line' that don't have the configuration line 'login authentication {list-name}'.

Router(config)# aaa authentication enable default method1 [method2...]

The same as above but for the privilege mode password, we look in the tacacs+ server and the local authentication is used only if the tacacs+ server is unreachable.

For more informations about Cisco AAA (very good docs) :
http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fsecur_c/fsaaa/index.htm

---------- End of Explainations ----------

Now we launch the tacacs+ server :

# tac_plus -C /etc/tac_plus.conf

Now the device should use the tacacs+ server for the authentication, we can use the users created in the tacacs+ configuration file.

# telnet switch
Trying 192.168.10.111...
Connected to switch.
Escape character is '^]'.
User Access Verification
Username: tifrere
Password:               // password : normal
switch>en
Password:               // password : enable
switch#

If you have any problem, use the command "debug aaa authentication" on the cisco to troubleshoot the tacacs server and verify what happens when you try to connect.
You can also try :

# tail -f /var/log/tac_plus.acct

First of all, you have to get the latest rancid sources from http://www.shrubbery.net/rancid/
We install rancid dependances and create the rancid user.
rancid-2.3.1 has been used in this document.
Rancid require installation of expect and cvs before being installed.

# apt-get install expect cvs

rancid user creation (this user will launch all rancid related process)

# adduser --home /home/rancid rancid

Once you've got the rancid archive, you have to uncompress it ... (in /usr/src for example)

# cp rancid-2.3.1.tar.gz /usr/src
# cd /usr/src
# tar xvfz rancid-2.3.1.tar.gz
# cd rancid-2.3.1

... and install it

Note : The following commands have to be typed as root. But once Rancid is installed, rancid user MUST be owner of his directory (chown -R rancid:rancid /home/rancid).

# ./configure -prefix=/home/rancid -localstatedir=/home/rancid/var/rancid
# make install

The README file in rancid archive is very well written and contain detailled informations, I kindly advise you to read it.

Now it's time to configure rancid.
We create a group in the rancid configuration :
File: /home/rancid/etc/rancid.conf

LIST_OF_GROUPS="mouarf"

---------- Explainations ----------
Groups permit to seperate diffents categories of devices, it just organize the way to get the configurations back.
Example : You have 3 groups

• Paris which will have all devices located in Paris.
• London which will have all devices located in London.
• Amsterdam which will have all devices located in Amsterdam.

You will use :

LIST_OF_GROUPS="Paris London Amsterdam"

---------- End of Explainations ----------

We create a rancid user in the tacacs+ configuration file :
File : /etc/tac_plus.conf

user = rancid {
login = cleartext "rancid_login"
enable = cleartext "rancid_enable"
name = "Rancid User"
}

Note : You could (strongly recommanded) use DES encryption for the passwords with the command tac_pwd (see previous section).

No we create rancid .cloginrc at the rancid root home directory (/home/rancid/.cloginrc).
This file will allow rancid to get logged automaticaly on the devices.

# /home/rancid/.cloginrc
add user * {rancid}
add password * {rancid_login} {rancid_enable}

As this file contains clear text passwords (you can't crypt them) you have to protect it. (And make sure rancid is the owner)

# chmod 600 .cloginrc
# chown rancid:rancid .cloginrc

Note : For more informations about clogin, a section at the end of this document describes it.

For the next section, for more informations, please read the rancid documentation which is very well written.
Now we launch rancid-cvs. This command MUST be launched by rancid user !

# su - rancid
$ /home/rancid/bin/rancid-cvs

This command create all necessary files and directories for every groups of the option LIST_OF_GROUPS et import them into CVS. This command MUST be launched every time a new group is added. Do not create directories or CVS repository manualy.
You can read man -M /home/rancid/man rancid-cvs for more informations.
The directories created will be :

• /home/rancid/var/rancid/group_name
• /home/rancid/var/rancid/CVS/group_name

Note : If /home/rancid/var/ranvid/CVS/group_name is not created : check the permissions, rancid has to be owner of his entire directory.
- delete /home/rancid/var/rancid/group_name
- relaunch rancid-cvs (as rancid user)

For each group, modify the file router.db
Each group has a directory in /home/rancid/var/rancid
In our example the file is : /home/rancid/var/rancid/mouarf/router.db

#hostname:os:status
switch1.office:cisco:up
router1.office:cisco:up

Note : Hostname MUST resolve ! Don't forget to add them in /etc/hosts

Launch rancid-run (as rancid user !! I will never say it too much)

$ /home/rancid/bin/rancid-run

rancid-run will connect automatically to switch1 and router1, will retrieve the configuration and will store it in /home/rancid/var/rancid/mouarf/configs/.
If you experience errors, check /var/log/rancid and correct errors until it's ok.
You need a webserver installed before installing/using cvsweb. Apache was used for this document.

# apt-get install cvsweb

Modify the cvsweb configuration file to create the group "mouarf" : File : /etc/cvsweb.conf

@CVSrepositories = (
        'local' => ['Local Repository', '/var/lib/cvs'],
        'mouarf' => ['mouarf devices', '/home/rancid/var/rancid/CVS'],
);

If the directory containing the cvsweb icons and css files is not in /var/www, you have to add a symbolic link :

# ln -s /usr/share/cvsweb /var/www/cvsweb

Configuration history is now available via cvsweb at the following url :
http://server_url/cgi-bin/cvsweb/mouarf/configs/?cvsroot=mouarf You have to cron the rancid-run every hours (for example, up to you the decide the frequency) to have the history of the configurations.
You have two methods to do it : Up to you to decide the one you want to use
1. Editing the file /etc/crontab

# RANCID
# run config differ hourly
1 * * * *       rancid  /home/rancid/bin/rancid-run
# clean out config differ logs
50 23 * * *     rancid  /usr/bin/find /home/rancid/var/logs -type f -mtime +2 -exec rm {} \;

2. Using the command crontab -e (as rancid user)

# RANCID
# run config differ hourly
1 * * * *       /home/rancid/bin/rancid-run
# clean out config differ logs
50 23 * * *     /usr/bin/find /home/rancid/var/logs -type f -mtime +2 -exec rm {} \;

Now you need tacacs+ server to be launched when the machine start.
Create the file /etc/init.d/tac_plus

#!/bin/sh
#file /etc/init.d/tac_plus
/usr/local/bin/tac_plus -C /etc/tac_plus.conf

Make it executable

# chmod 755 /etc/init.d/tac_plus

Create a symbolic link in rc2.d and rc3.d (depending your default init level, see /etc/inittab)

# cd /etc/rc2.d
# ln -s ../init.d/tac_plus S92tac_plus
# cd /etc/rc3.d
# ln -s ../init.d/tac_plus S92tac_plus

Add /home/rancid/bin in your environment variables (for easier use of clogin)
Or you can create a symbolic link in /usr/bin

# cd /usr/bin
# ln -s /home/rancid/bin/clogin clogin

Important Note : It seems that clogin fails when there is a motd banner on cisco devices, if you want to be sure that rancid will properly backup your configs, make sure that there is no motd banner on your equipment.
You can add the alias rancid-rancid_group in the local mail server to receive the cvs diff by mail every time there is a configuration change.

To have a better way to log into your network device we will create a user account per administrator that have rights to connect to the devices.

# adduser --home /home/foobar foobar

Edit the /etc/tac_plus.conf file and add the following lines

user = foobar {
        login = des "the_DES_crypted password"
        enable = des "the_DES_crypted password"
        name = "Foobar User"
}

Note : You can prevent the user to be in priviliged mode if you comment or delete the "enable..." line.

create the file /home/foobar/.cloginrc

# if the user dont have a privileged account
# add noenable * {1}
add user * {foobar}
add password * {pass_login} {pass_enable}

Note : Password are in clear text in this file, it has to be in chmod 600 and user foobar has to be owner of this file. Only root and foobar will be able to read it.

Information :
The line "add noenable * {1}" concern only the users which don't have priviliged acces on the devices.
Even if the user remove this line on his .cloginrc file, he won't have a priviliged access because it's not specified in his tacacs+ account.
This line is just to prevent clogin to try to get priviliged access because user don't have this right.

Once this file is created, the user will just have to do "clogin device_name" and will be automatically logged in. And if this user has a privileged account, he will be directly logged in the privileged mode.
The advantage of clogin is to script commands :

clogin -c "sh ver" equipment_name > file.txt

This command will make the user logged into the equipment and will execute the "show version" command and will disconnect the user.
The result of the command will be stored in file.txt
You can also do automatic configuration on multiple equipement :

clogin -c "conf t;interface g0/1;no shut; end; wr mem" router1 router2

This command will enable gigabitethernet port 0/1 on both router1 and router2.
You can also specify a file with multiple commands in parameter of clogin.
See man -M /home/rancid/man clogin for more informations.