TAC_PLUS AAA 平台及web展示

1 介绍

AAA是认证（Authentication）、授权（Authorization）和计费（Accounting）的简称，是网络安全中进行访问控制的一种安全管理机制，提供认证、授权和计费三种安全服务。

TACACS & TACACS+：Terminal Access Controller Access Control，System终端访问控制器访问控制系统。通过一个或多个中心服务器为路由器、网络访问控制器以及其它网络处理设备提供了访问控制服务。TACACS支持独立的认证（Authentication）、授权（Authorization）和计费（Accounting）功能。

2 安装

2.1 Ubuntu 安装

Ubuntu 20.04 之后不再支持tacacs，最好是使用Ubuntu18.04

1、安装

# 下载并安装 TACACS+  
### 不能使用apt来安装，Ubuntu 20.04 之后不再支持
### 可以在Ubuntu 18.04 或者同样版本的镜像上安装
apt-get update
apt-get install tacacs+

## 配置文件
vim tac_plus.conf
---------------------------------------------------
key = "tacacs123" #tacacs?key
accounting syslog;
accounting file = /var/log/tacacs_accounting.log   #tail -f /var/log/tacacs_accounting.log
default authentication = file /etc/passwd


acl = network_admin {
   
        # allow access from all sources
        #permit = ^10\.
        permit =  ^115\.
        permit = [0-9]{
   1,3}\.
        # implicit deny (ie: anything else)
}


group = admin {
   
    default service = permit
    acl = network_admin
    service = exec {
   
         priv-lvl = 15
    }
    cmd = display {
   
        permit .*
    }
}
group = operator {
   
    acl = network_admin
    service = exec {
   
         priv-lvl = 1
    }
    cmd = display {
   
        permit .*
    }
    cmd = show {
   
        permit .*
    }
}
group = ro {
   
    acl = network_admin
    service = exec {
   
         priv-lvl = 15
    }
    cmd = display {
   
        permit .*
    }
    cmd = show {
   
        permit .*
    }
    cmd = interface {
   
        permit .*
    }
    cmd = undo {
   
        permit shutdown
    }
    cmd = configure {
   
        permit .*
    }
    cmd = no {
   
        permit shutdown
    }
    cmd = exit {
   
        permit .*
    }
    cmd = quit {
   
        permit .*
    }
    cmd = screen-length {
   
        permit .*
    }
    cmd = terminal {
   
        permit .*
    }
    cmd = set {
   
        permit cli.*
    }
    cmd = ping {
   
        permit .*
    }
    cmd = tracert {
   
        permit .*
    }
    cmd = admin {
   
        permit show
    }
    cmd = shutdown {
   
        permit .*
    }
}

user = chen_admin {
                    #chen_admin：账号
    login = des aPzSgJMfBUGB2  #使用 tac_pwd，生成账号密码：7FLiiVJUDhin2
    # expires = "Feb 20 2032"
    member = admin                 #权限
}

user = chen_ro {
   
    login = des temjCCsjBECmU
    # expires = "Feb 20 2032"
    member = ro                      #权限
}

####### 生成密码
tac_pwd 
Password to be encrypted: admin@123
aPzSgJMfBUGB2

tac_pwd 
Password to be encrypted: test123
temjCCsjBECmU


## 启动守护进程
/etc/init.d/tacacs_plus restart
 * Restarting TACACS+ authentication daemon tacacs+                                                                                                                                                                      [ OK ] 

2、配置文件解释

cat /etc/tacacs+/tac_plus.conf 
# Created by Henry-Nicolas Tourneur(henry.nicolas@tourneur.be)
# See man(5) tac_plus.conf for more details

# Define where to log accounting data, this is the default.
###  TACACS+ 账户的日志文件
accounting file = /var/log/tac_plus.acct

# This is the key that clients have to use to access Tacacs+
## TACACS+ 密钥
key = testing123

# Use /etc/passwd file to do