mirror of https://github.com/facebook/tac_plus
Merge pull request #21 from facebook/header_copyright
Add Copyright comments to all source files
This commit is contained in:
commit
f5dfaa3b3f
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: acct.c,v 1.11 2009-04-21 15:59:25 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: aceclnt_fn.c,v 1.00 2012-02-24 18:40:20 maddison Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: authen.c,v 1.13 2009-04-10 18:46:43 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: author.c,v 1.10 2009-03-17 18:31:27 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
@ -59,14 +60,14 @@ author(u_char *pak)
|
|||
send_error_reply(TAC_PLUS_AUTHOR, NULL);
|
||||
return;
|
||||
}
|
||||
|
||||
|
||||
/* arg counts start here */
|
||||
p = pak + TAC_PLUS_HDR_SIZE + TAC_AUTHOR_REQ_FIXED_FIELDS_SIZE;
|
||||
|
||||
/* Length checks */
|
||||
len = TAC_AUTHOR_REQ_FIXED_FIELDS_SIZE;
|
||||
len += apak->user_len + apak->port_len + apak->rem_addr_len + apak->arg_cnt;
|
||||
|
||||
|
||||
/* Is there enough space for apak->arg_cnt arguments? */
|
||||
if (ntohl(hdr->datalength) <
|
||||
(TAC_AUTHOR_REQ_FIXED_FIELDS_SIZE + apak->arg_cnt)) {
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: choose_authen.c,v 1.8 2009-03-18 18:59:17 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
// Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
#include "tac_plus.h"
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: config.c,v 1.48 2009-04-10 16:19:04 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: default_fn.c,v 1.14 2009-03-17 18:38:12 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: default_v0_fn.c,v 1.8 2009-03-17 18:38:12 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
|
|
@ -1,9 +1,10 @@
|
|||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* s_p.h - contains combined Sbox and P permutation table
|
||||
*/
|
||||
|
||||
static unsigned long S_P[8][64] = {
|
||||
/* SBOX 1 */
|
||||
/* SBOX 1 */
|
||||
0x820200, 0x20000, 0x80800000, 0x80820200,
|
||||
0x800000, 0x80020200, 0x80020000, 0x80800000,
|
||||
0x80020200, 0x820200, 0x820000, 0x80000200,
|
||||
|
|
@ -20,7 +21,7 @@ static unsigned long S_P[8][64] = {
|
|||
0x800000, 0x80000200, 0x80020000, 0,
|
||||
0x20000, 0x800000, 0x80800200, 0x820200,
|
||||
0x80000000, 0x80820000, 0x200, 0x80020200,
|
||||
/* SBOX 2 */
|
||||
/* SBOX 2 */
|
||||
0x10042004, 0, 0x42000, 0x10040000,
|
||||
0x10000004, 0x2004, 0x10002000, 0x42000,
|
||||
0x2000, 0x10040004, 0x4, 0x10002000,
|
||||
|
|
@ -37,7 +38,7 @@ static unsigned long S_P[8][64] = {
|
|||
0x4, 0x10042004, 0x42000, 0x10040000,
|
||||
0x10040004, 0x40000, 0x2004, 0x10002000,
|
||||
0x10002004, 0x4, 0x10040000, 0x42000,
|
||||
/* SBOX 3 */
|
||||
/* SBOX 3 */
|
||||
0x41000000, 0x1010040, 0x40, 0x41000040,
|
||||
0x40010000, 0x1000000, 0x41000040, 0x10040,
|
||||
0x1000040, 0x10000, 0x1010000, 0x40000000,
|
||||
|
|
@ -54,7 +55,7 @@ static unsigned long S_P[8][64] = {
|
|||
0x10000, 0x1000040, 0x41000040, 0x10040,
|
||||
0x1000040, 0, 0x41010000, 0x40000040,
|
||||
0x41000000, 0x40010040, 0x40, 0x1010000,
|
||||
/* SBOX 4 */
|
||||
/* SBOX 4 */
|
||||
0x100402, 0x4000400, 0x2, 0x4100402,
|
||||
0, 0x4100000, 0x4000402, 0x100002,
|
||||
0x4100400, 0x4000002, 0x4000000, 0x402,
|
||||
|
|
@ -71,7 +72,7 @@ static unsigned long S_P[8][64] = {
|
|||
0x4100402, 0x2, 0x4000400, 0x100402,
|
||||
0x100002, 0x100400, 0x4100000, 0x4000402,
|
||||
0x402, 0x4000000, 0x4000002, 0x4100400,
|
||||
/* SBOX 5 */
|
||||
/* SBOX 5 */
|
||||
0x2000000, 0x4000, 0x100, 0x2004108,
|
||||
0x2004008, 0x2000100, 0x4108, 0x2004000,
|
||||
0x4000, 0x8, 0x2000008, 0x4100,
|
||||
|
|
@ -88,7 +89,7 @@ static unsigned long S_P[8][64] = {
|
|||
0x2004008, 0x2004100, 0x108, 0x4000,
|
||||
0x4100, 0x2004008, 0x2000100, 0x108,
|
||||
0x8, 0x4108, 0x2004000, 0x2000008,
|
||||
/* SBOX 6 */
|
||||
/* SBOX 6 */
|
||||
0x20000010, 0x80010, 0, 0x20080800,
|
||||
0x80010, 0x800, 0x20000810, 0x80000,
|
||||
0x810, 0x20080810, 0x80800, 0x20000000,
|
||||
|
|
@ -105,7 +106,7 @@ static unsigned long S_P[8][64] = {
|
|||
0x20000010, 0x20080000, 0x80810, 0,
|
||||
0x800, 0x20000010, 0x20000810, 0x20080800,
|
||||
0x20080000, 0x810, 0x10, 0x20080010,
|
||||
/* SBOX 7 */
|
||||
/* SBOX 7 */
|
||||
0x1000, 0x80, 0x400080, 0x400001,
|
||||
0x401081, 0x1001, 0x1080, 0,
|
||||
0x400000, 0x400081, 0x81, 0x401000,
|
||||
|
|
@ -122,7 +123,7 @@ static unsigned long S_P[8][64] = {
|
|||
0x81, 0x1000, 0x401081, 0x400000,
|
||||
0x401080, 0x1, 0x1001, 0x401081,
|
||||
0x400001, 0x401080, 0x401000, 0x1001,
|
||||
/* SBOX 8 */
|
||||
/* SBOX 8 */
|
||||
0x8200020, 0x8208000, 0x8020, 0,
|
||||
0x8008000, 0x200020, 0x8200000, 0x8208020,
|
||||
0x20, 0x8000000, 0x208000, 0x8020,
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: do_acct.c,v 1.13 2009-03-17 18:38:12 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,5 +1,7 @@
|
|||
#!/usr/bin/python
|
||||
|
||||
# Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
|
||||
# Program I threw together to do the things tac_plus won't
|
||||
# It allows very granular control. Please visit tacacs.org as
|
||||
# this is continually updated
|
||||
|
|
@ -48,10 +50,10 @@
|
|||
'''
|
||||
do_auth.py [-options]
|
||||
Version 1.9
|
||||
do_auth is a python program I wrote to work as an authorization script for
|
||||
do_auth is a python program I wrote to work as an authorization script for
|
||||
tacacs to allow greater flexability in tacacs authentication. It allows
|
||||
a user to be part of many predefined groups that can allow different
|
||||
access to different devices based on ip, user, and source address.
|
||||
access to different devices based on ip, user, and source address.
|
||||
|
||||
Do not play with do_auth untill you have a firm grasp on tac_plus!
|
||||
|
||||
|
|
@ -64,28 +66,28 @@ Do not play with do_auth untill you have a firm grasp on tac_plus!
|
|||
are ignored and can be omitted. $name
|
||||
-f Config Filename. Default is do_auth.ini.
|
||||
-l Logfile. Default is log.txt.
|
||||
-D Debug mode. Allows you to call the program without reading
|
||||
-D Debug mode. Allows you to call the program without reading
|
||||
from stdin. Useful to test your configuration before going
|
||||
live. Sets a default command of "show users wides".
|
||||
|
||||
Groups are assigned to users in the [users] section. A user must
|
||||
be assigned to one or more groups, one per line. Groups are defined
|
||||
in brackets, but can be any name. Each group can have up to 6 options
|
||||
be assigned to one or more groups, one per line. Groups are defined
|
||||
in brackets, but can be any name. Each group can have up to 6 options
|
||||
as defined below.
|
||||
|
||||
host_deny Deny any user coming from this host. Optional.
|
||||
host_allow Allow users from this range. Mandatory if
|
||||
host_allow Allow users from this range. Mandatory if
|
||||
-i is specified.
|
||||
device_deny Deny any device with this IP. Optional.
|
||||
device_permit Allow this range. Mandatory if -d is specified
|
||||
command_deny Deny these commands. Optional.
|
||||
command_permit Allow these commands. Mandatory.
|
||||
av_pairs list of av pairs to replace if found. Optional - be careful
|
||||
av_pairs list of av pairs to replace if found. Optional - be careful
|
||||
|
||||
The options are parsed in order till a match is found. Obviously,
|
||||
The options are parsed in order till a match is found. Obviously,
|
||||
for login, the commands section is not parsed. If a match is not
|
||||
found, or a deny is found, we move on to the next group. At the
|
||||
end, we have an implicit deny if no groups match.
|
||||
end, we have an implicit deny if no groups match.
|
||||
|
||||
An simple example is as follows.
|
||||
|
||||
|
|
@ -96,24 +98,24 @@ homer =
|
|||
stimpy =
|
||||
television_group
|
||||
[simpson_group]
|
||||
host_deny =
|
||||
host_deny =
|
||||
1.1.1.1
|
||||
1.1.1.2
|
||||
host_allow =
|
||||
host_allow =
|
||||
1.1.1.*
|
||||
device_permit =
|
||||
device_permit =
|
||||
10.1.1.*
|
||||
command_permit =
|
||||
.*
|
||||
[television_group]
|
||||
host_allow =
|
||||
.*
|
||||
device_permit =
|
||||
device_permit =
|
||||
.*
|
||||
command_permit =
|
||||
command_permit =
|
||||
show.*
|
||||
|
||||
Example tacacs line: after authorization "/usr/bin/python
|
||||
|
||||
Example tacacs line: after authorization "/usr/bin/python
|
||||
/root/do_auth.pyc -i $address -fix_crs_bug -u $user -d $name -l /root/log.txt
|
||||
-f /root/do_auth.ini"
|
||||
(that's one line)
|
||||
|
|
@ -125,7 +127,7 @@ Think of "av_pairs" as a find/replace function.
|
|||
av_pairs =
|
||||
priv-lvl=1
|
||||
|
||||
Brocade has a brocade-privlvl which I like. It maps priv-lvl to
|
||||
Brocade has a brocade-privlvl which I like. It maps priv-lvl to
|
||||
brocade-privlvl, but priv-lvl=1 results in interface privileges. Here
|
||||
is an example of how to map to brocade-privlvl=5 which has no modification
|
||||
rights. Unfortunately, it does require you to put in the IP's of your gear.
|
||||
|
|
@ -143,7 +145,7 @@ av_pairs =
|
|||
|
||||
You could also put "priv-lvl=15,brocade-privlvl=5" or whatever your
|
||||
tac_plus deamon is passing; as long as it's a match it accomplished the same
|
||||
thing. In this example, we essentially replace the whole av_pair resulting
|
||||
thing. In this example, we essentially replace the whole av_pair resulting
|
||||
in the user having only read access. Alternatively, a good "disable account"
|
||||
can be created by simpley doing:
|
||||
|
||||
|
|
@ -153,20 +155,20 @@ av_pairs =
|
|||
This results in the brocades having read/only, and the Cisco's go into disable
|
||||
because they don't understand it. (We're assuming that the user has no enable
|
||||
account or the priv-lvl is pointless) You could also add a shell role for nexus,
|
||||
which we will discuss next. (shell:roles="network-admin")
|
||||
which we will discuss next. (shell:roles="network-admin")
|
||||
|
||||
NEXUS - Due to a slight change in the nexus, do_auth is able to
|
||||
NEXUS - Due to a slight change in the nexus, do_auth is able to
|
||||
discern if a device is a nexus or not. In tac_plus, do the following:
|
||||
|
||||
service = exec {
|
||||
priv-lvl = 1
|
||||
priv-lvl = 1
|
||||
shell:roles=\"\\"network-operator\\""
|
||||
idletime = 3
|
||||
idletime = 3
|
||||
timeout = 15
|
||||
}
|
||||
}
|
||||
after authorization <do_auth yada yada>
|
||||
|
||||
This configuration does NOT work without do_auth. However, WITH do_auth,
|
||||
This configuration does NOT work without do_auth. However, WITH do_auth,
|
||||
do_auth will only send shell:roles to Nexus switches, allowing your
|
||||
other gear to work correctly. Simply put av_pairs in your do_auth, and
|
||||
it will figure it out for you. (If not, it won't touch them. The logic is
|
||||
|
|
@ -174,33 +176,33 @@ simple: If (av_pairs in .ini): Then (do_stuff), Else (exit(2)- Don't modify 'em!
|
|||
|
||||
Roles can also be modified in a do_auth group, as below:
|
||||
|
||||
av_pairs =
|
||||
av_pairs =
|
||||
priv-lvl=15
|
||||
shell:roles="network-admin"
|
||||
|
||||
Also of note, you MUST USE DOUBLE QUOTES to get tac_plus to correctly
|
||||
pass "network-operator" in the service example above. UNLESS you are
|
||||
pass "network-operator" in the service example above. UNLESS you are
|
||||
modifying the key with do_auth in av_pairs - it will fix the quotes.
|
||||
|
||||
BUGS: You must know your regular expressions. If you enter a bad
|
||||
expression, such as *. instead of .*, python re will freak out and
|
||||
expression, such as *. instead of .*, python re will freak out and
|
||||
not evaluate the expression. (Thought about netaddr, but would you
|
||||
really install it?)
|
||||
|
||||
CAVEATS: One group can not take away what another group grants via deny.
|
||||
If a match is not found, it will go on to the next group. If a deny is
|
||||
matched, it will go on to the next group.
|
||||
Order is crucial - the groups should go from more specific to less
|
||||
If a match is not found, it will go on to the next group. If a deny is
|
||||
matched, it will go on to the next group.
|
||||
Order is crucial - the groups should go from more specific to less
|
||||
specific. In the above example, if television_group was put before
|
||||
simpson_group, simpson_group would never be called because
|
||||
televsion_group catches everything in device_permit.
|
||||
simpson_group, simpson_group would never be called because
|
||||
televsion_group catches everything in device_permit.
|
||||
|
||||
HELP: If somebody has a WLC or other unknown network equipment, I
|
||||
HELP: If somebody has a WLC or other unknown network equipment, I
|
||||
require some testing/sniffing done - thanks!!
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License version 3 or any
|
||||
later version as published by the Free Software Foundation,
|
||||
later version as published by the Free Software Foundation,
|
||||
http://www.gnu.org/
|
||||
|
||||
This program is distributed in the hope that it will be useful, but
|
||||
|
|
@ -219,12 +221,12 @@ from time import strftime
|
|||
def get_attribute(config, the_section, the_option, log_file, filename):
|
||||
if not config.has_section(the_section):
|
||||
log_file.write(strftime("%Y-%m-%d %H:%M:%S: ")
|
||||
+ "Error: Section '%s' does not exist in %s\n"
|
||||
+ "Error: Section '%s' does not exist in %s\n"
|
||||
% (the_section, filename))
|
||||
sys.exit(1)
|
||||
if not config.has_option(the_section, the_option):
|
||||
log_file.write(strftime("%Y-%m-%d %H:%M:%S: ")
|
||||
+ "Error: Option '%s' does not exist in section %s in file %s\n"
|
||||
+ "Error: Option '%s' does not exist in section %s in file %s\n"
|
||||
% (the_option, the_section, filename))
|
||||
sys.exit(1)
|
||||
#Should not have any exceptions - BUT, just in case
|
||||
|
|
@ -232,23 +234,23 @@ def get_attribute(config, the_section, the_option, log_file, filename):
|
|||
attributes = config.get(the_section, the_option)
|
||||
except ConfigParser.NoSectionError:
|
||||
log_file.write(strftime("%Y-%m-%d %H:%M:%S: ")
|
||||
+ "Error: Section '%s' Doesn't Exist!\n"
|
||||
+ "Error: Section '%s' Doesn't Exist!\n"
|
||||
% (the_section))
|
||||
sys.exit(1)
|
||||
except ConfigParser.DuplicateSectionError:
|
||||
log_file.write(strftime("%Y-%m-%d %H:%M:%S: ")
|
||||
+ "Error: Duplicate section '%s'\n"
|
||||
+ "Error: Duplicate section '%s'\n"
|
||||
% (the_section))
|
||||
sys.exit(1)
|
||||
except ConfigParser.NoOptionError:
|
||||
log_file.write(strftime("%Y-%m-%d %H:%M:%S: ")
|
||||
+ "Error: '%s' not found in section '%s\n'"
|
||||
+ "Error: '%s' not found in section '%s\n'"
|
||||
% (the_option, the_section))
|
||||
sys.exit(1)
|
||||
#To do: finish exceptions.
|
||||
#To do: finish exceptions.
|
||||
except ConfigParser.ParsingError:
|
||||
log_file.write(strftime("%Y-%m-%d %H:%M:%S: ")
|
||||
+ "Error: Can't parse file '%s'! (You got me)\n"
|
||||
+ "Error: Can't parse file '%s'! (You got me)\n"
|
||||
% (filename))
|
||||
sys.exit(1)
|
||||
attributes = attributes.split('\n')
|
||||
|
|
@ -272,9 +274,9 @@ def check_username(config, log_file, user_name):
|
|||
return False
|
||||
|
||||
# If match item in our_list, true, else false
|
||||
# Example - if deny section has a match for 10.1.1.1,
|
||||
# Example - if deny section has a match for 10.1.1.1,
|
||||
# return True, else False
|
||||
# If the section doesn't exist, we assume an
|
||||
# If the section doesn't exist, we assume an
|
||||
# impicity deny/false
|
||||
|
||||
def match_it(the_section, the_option, match_item, config, log_file, filename):
|
||||
|
|
@ -285,7 +287,7 @@ def match_it(the_section, the_option, match_item, config, log_file, filename):
|
|||
if re.match(item,match_item):
|
||||
return True
|
||||
return False
|
||||
|
||||
|
||||
def main():
|
||||
#Defaults
|
||||
filename = "do_auth.ini"
|
||||
|
|
@ -294,12 +296,12 @@ def main():
|
|||
ip_addr = ""
|
||||
device = ""
|
||||
is_debug = False
|
||||
|
||||
|
||||
argv = sys.argv
|
||||
try:
|
||||
optlist, args = getopt.getopt(sys.argv[1:], 'i:u:f:l:d:?:D', ['fix_crs_bug','?', '-?', 'help', 'Help'])
|
||||
except getopt.GetoptError, err:
|
||||
print str(err)
|
||||
print str(err)
|
||||
print __doc__
|
||||
sys.exit(1)
|
||||
for (i, j) in optlist:
|
||||
|
|
@ -349,7 +351,7 @@ def main():
|
|||
# I don't use any other service other than shell to test!
|
||||
the_command = ""
|
||||
return_pairs = ""
|
||||
if (av_pairs[0] == "service=shell\n"):
|
||||
if (av_pairs[0] == "service=shell\n"):
|
||||
if av_pairs[1] == ("cmd=\n"): # #&*@ Nexus!
|
||||
if len(av_pairs) > 2:
|
||||
#DEBUG
|
||||
|
|
@ -374,7 +376,7 @@ def main():
|
|||
elif av_pairs[1].startswith("cmd*"): #Anybody know why it's "cmd*"?
|
||||
if len(av_pairs) > 2:
|
||||
return_pairs = av_pairs[2:] #You MUST strip the "cmd*" av-pair
|
||||
# Definately not a Nexus, so strip any nexus pair
|
||||
# Definately not a Nexus, so strip any nexus pair
|
||||
for item in return_pairs:
|
||||
if item.startswith("shell:roles"):
|
||||
return_pairs.remove(item)
|
||||
|
|
@ -387,7 +389,7 @@ def main():
|
|||
config = ConfigParser.SafeConfigParser()
|
||||
if not (filename in config.read(filename)):
|
||||
log_file.write(strftime("%Y-%m-%d %H:%M:%S: ")
|
||||
+ "Error: Can't open/parse '%s'\n"
|
||||
+ "Error: Can't open/parse '%s'\n"
|
||||
% (filename))
|
||||
sys.exit(1)
|
||||
the_section = "users"
|
||||
|
|
@ -400,7 +402,7 @@ def main():
|
|||
groups = get_attribute(config, "users", "default", log_file, filename)
|
||||
else:
|
||||
groups = get_attribute(config, "users", user_name, log_file, filename)
|
||||
|
||||
|
||||
for this_group in groups:
|
||||
if ip_addr:
|
||||
if match_it(this_group, "host_deny", ip_addr, config, log_file, filename):
|
||||
|
|
@ -453,7 +455,7 @@ def main():
|
|||
# log_file.write('Thing:' + thing + '\n')
|
||||
for item2 in temp_av_pairs:
|
||||
item2 = item2.strip()
|
||||
if item2.find(',') > -1:
|
||||
if item2.find(',') > -1:
|
||||
splt2 = item2.split(',')
|
||||
if len(splt2) > 1:
|
||||
#splt3 = splt2[0].split('=')
|
||||
|
|
@ -479,11 +481,11 @@ def main():
|
|||
|
||||
# First, let's make sure we're doing service = shell. If not, just
|
||||
# allow it. I currently have little knowledge of cmd's sent by other
|
||||
# services which is why this code is a little klugy.
|
||||
# services which is why this code is a little klugy.
|
||||
if return_pairs:
|
||||
splt = av_pairs[0].split('=') # Removed service in return_pairs
|
||||
if len(splt) > 1:
|
||||
if not splt[1].strip() == 'shell':
|
||||
if not splt[1].strip() == 'shell':
|
||||
log_file.write(strftime("%Y-%m-%d %H:%M:%S: ")
|
||||
+ "User '%s' granted non-shell access to device '%s' in group '%s' from '%s'\n"
|
||||
% (user_name, device, this_group, ip_addr))
|
||||
|
|
@ -531,7 +533,7 @@ def main():
|
|||
log_file.write(strftime("%Y-%m-%d %H:%M:%S: ")
|
||||
+ "User '%s' not allowed command '%s' to device '%s' in any group\n"
|
||||
% (user_name, the_command, device))
|
||||
#Can't... remember why I added this given the implicit deny
|
||||
#Can't... remember why I added this given the implicit deny
|
||||
sys.exit(1)
|
||||
else:
|
||||
continue
|
||||
|
|
@ -542,6 +544,6 @@ def main():
|
|||
+ "User '%s' not allowed access to device '%s' from '%s' in any group\n"
|
||||
% (user_name, device, ip_addr))
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
main()
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: do_author.c,v 1.14 2009-03-17 18:38:12 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: dump.c,v 1.12 2009-03-18 21:09:26 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: encrypt.c,v 1.8 2009-03-17 18:38:12 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: expire.c,v 1.8 2006-12-13 01:11:37 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: expire.h,v 1.4 2006-12-13 00:49:14 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1991 David G. Koontz.
|
||||
* All rights reserved.
|
||||
*
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1990 David G. Koontz.
|
||||
* All rights reserved.
|
||||
*
|
||||
|
|
@ -65,4 +66,3 @@ union block_48 {
|
|||
void tac_des(union LR_block *);
|
||||
void tac_des_loadkey(unsigned char *, int);
|
||||
void tac_set_des_mode(int);
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: hash.c,v 1.5 2006-12-13 01:11:37 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
// Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
#include "tac_plus.h"
|
||||
#include <stdlib.h>
|
||||
#include <unistd.h>
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: maxsess.c,v 1.12 2009-07-16 18:13:19 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: maxsess.c,v 1.12 2009-07-16 18:13:19 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: md4.c,v 1.8 2009-03-18 17:48:10 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: md5.c,v 1.8 2006-12-13 00:49:14 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
/*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: mschap.h,v 1.3 2006-07-01 02:19:52 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: packet.c,v 1.22 2009-03-18 21:09:26 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: parse.c,v 1.15 2009-03-17 18:40:20 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: parse.h,v 1.13 2009-03-18 23:24:54 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
// Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
#ifndef PATHSL_H
|
||||
#define PATHSL_H
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: programs.c,v 1.13 2009-06-02 18:08:00 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: pw.c,v 1.7 2009-03-18 17:48:59 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: pwlib.c,v 1.25 2009-03-17 18:40:20 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: report.c,v 1.16 2009-07-16 16:58:23 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: sendauth.c,v 1.7 2009-03-17 18:40:20 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: sendpass.c,v 1.6 2006-12-13 01:11:37 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: skey_fn.c,v 1.10 2009-03-17 18:40:20 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: tac_plus.c,v 1.59 2009-07-16 23:31:26 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* TACACS_PLUS daemon suitable for using on Unix systems.
|
||||
*
|
||||
* October 1994, Lol Grant
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: tac_plus.h,v 1.55 2009/07/17 16:10:52 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: tac_pwd.c,v 1.15 2006-12-13 01:11:37 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: tacacs.h,v 1.1 2009-07-17 16:10:52 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
/*
|
||||
* $Id: utils.c,v 1.14 2009-03-18 21:22:28 heas Exp $
|
||||
*
|
||||
* Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved
|
||||
* Copyright (c) 1995-1998 by Cisco systems, Inc.
|
||||
*
|
||||
* Permission to use, copy, modify, and distribute this software for
|
||||
|
|
|
|||
Loading…
Reference in New Issue