Documentation Tacacs Users Users User Fields Description

User configuration example

  user = ciscoasa {
    login = mavis # Local Database
    pap = login # Clone login
    enable = login # Clone login
    server = permit asa5505 # 172.31.255.102
    server = permit Catalyst2960 # 172.31.255.101
    server = deny 0.0.0.0/0 # permit ONLY
    ###Service demo-ciscoasa START###
    service = shell {
      set priv-lvl = 15
      ###CMD Attr show_version_only START###
      cmd = show {
        permit /version.*/
        deny /.*/
      } #END OF CMD Attr show_version_only
      ###CMD Attr exit START###
      cmd = exit {
        permit .* # default permit any
      } #END OF CMD Attr exit
    } #END OF Cisco Router/Switch Service
    ###Service demo-ciscoasa END###
###MANUAL CONFIGURATION START###
# here is manual configuration parameters
# use char # to make comment
###MANUAL CONFIGURATION END###
  } #END OF ciscoasa

Fields Description

Form Label Nametac_plus ParameterDescriptionImport/Variable nameImport/Value
Username
required
userThe unique usernameusernamestring
User GroupgroupUser can be a member of several group. There are different types of user groups, please see more info here.N/AN/A
Login PasswordloginUser passwordloginstring
Type of storing
login
N/ASelect how to store login password:
  • Clear Text
  • MD5
  • MD5 (hashed)
  • Local Database (MAVIS)
  • Local Database (MAVIS via email)
  • Get from OTP (MAVIS)
  • Get from OTP (MAVIS via email)
  • Get from LDAP (MAVIS)
  • Get from SMS (MAVIS)
login_flagOne of (number):
  • 0 - Clear Text
  • 1 - MD5
  • 2 - MD5 (hashed)
  • 3 - Local Database (MAVIS)
  • 5 - Local Database (MAVIS via email)
  • 10 - Get from OTP (MAVIS)
  • 12 - Get from OTP (MAVIS via email)
  • 20 - Get from LDAP (MAVIS)
  • 30 - Get from SMS (MAVIS)

Enable PasswordenableEnable passwordenablestring
Type of storing
enable
N/ASelect how to store enable password:
  • Clear Text
  • MD5
  • MD5 (hashed)
  • Clone Login password
enable_flagOne of (number):
  • 0 - Clear Text
  • 1 - MD5
  • 2 - MD5 (hashed)
  • 4 - Clone Login password

ServiceserviceUser can belong to several services. The first matched service will be applied. Service is a part of configuration that give NAS (device) information about authorization settings of a user.N/AN/A
Access Control ListaclaclOne of (number):
  • acl id
  • acl name
Default Service Permitdefault serviceAllow any service request from NAS (device) if checked, else deny all unknown services from NAS (device).default_serviceOne of (number):
0 - Deny
1 - Permit
MessagemessageThe message that will appeared after user log inmessagestring
Access Control / Action For The List BelowN/AThere are two position:
  • Permit ONLY below list (list of device and device group)
  • Permit all EXCEPT list below (list of device and device group)
N/AN/A
Access Control / Device Listserver = permit/denyAllowed or Denied (based on parameter above) device list for that userN/AN/A
Access Control / Device Groupserver = permit/denyAllowed or Denied (based on parameter above) device group list for that userN/AN/A
Extra Options / PAP AuthenticationpapPAP passwordpapstring
Extra Options / Type of storing
pap
N/ASelect how to store pap password:
  • Clear Text
  • MD5
  • MD5 (hashed)
  • Clone Login password
pap_flagOne of (number):
  • 0 - Clear Text
  • 1 - MD5
  • 2 - MD5 (hashed)
  • 4 - Clone Login password
Extra Options / CHAP AuthenticationchapCHAP password (stored as clear text)chapstring
Extra Options / MS-CHAP Authenticationms-chapMS-CHAP password (stored as clear text)ms_chapstring
Manual ConfigurationN/AConfiguration parameters based on Marc Huber manual. It will added after main configurationmanualstring
Valid Fromvalid fromSet lifetime for uservalid_fromdate
Valid Untilvalid untilSet lifetime for uservalid_untildate
DisabledN/AIf checked, user will disappear from tac_plus configuration filedisabled0 - enabled
1 - disabled