Networ-king: Tacacs

Showing posts with label Tacacs. Show all posts

Wednesday, October 17, 2018

Cisco MACs (OUI) addresses - all of them

00:00:0C        Cisco                  # CISCO SYSTEMS, INC.
00:01:42        Cisco                  # CISCO SYSTEMS, INC.
00:01:43        Cisco                  # CISCO SYSTEMS, INC.
00:01:63        Cisco                  # CISCO SYSTEMS, INC.
00:01:64        Cisco                  # CISCO SYSTEMS, INC.
00:01:96        Cisco                  # CISCO SYSTEMS, INC.
00:01:97        Cisco                  # CISCO SYSTEMS, INC.
00:01:C7        Cisco                  # CISCO SYSTEMS, INC.
00:01:C9        Cisco                  # CISCO SYSTEMS, INC.
00:02:16        Cisco                  # CISCO SYSTEMS, INC.
00:02:17        Cisco                  # CISCO SYSTEMS, INC.
00:02:3D        Cisco                  # Cisco Systems, Inc.
00:02:4A        Cisco                  # CISCO SYSTEMS, INC.

PIX525 - Part I.

PIX525 - ASA Firewall

Password recovery howto step-by-step

This platform has an Unrestricted (UR) license.
--------------------------------------------------------------------------
                                 .            .
                                 |            |
                                |||          |||
                              .|| ||.      .|| ||.
                           .:||| | |||:..:||| | |||:.
                            C i s c o S y s t e m s
--------------------------------------------------------------------------

Turn on just ONE of the devices - choose which is going to be primary.

When logged in issue command:

write erase

reload

When boot up again, let's configure it!

As one of the devices still had a configuration i had to perform a Password Recovery - if you are used from other Cisco devices like Switches and Routers -- not so easy.
Special file is needed with Password Tool and also connection to TFTP server.

So first, let's run our TFTP server from C2811 router:

tftp-server file usbflash0:8529-np70.bin

When you have TFTP ready, prepare interface for connection to PIX. I set-up 172.17.17.17 as IP address and connected Fa0/1 to Ethernet 0 on PIX.

Use BREAK or ESC to interrupt flash boot.
Use SPACE to begin flash boot immediately.
Flash boot interrupted.
0: i8255X @ PCI(bus:0 dev:14 irq:10)
1: i8255X @ PCI(bus:0 dev:13 irq:11)

Ethernet auto negotiation timed out.
Ethernet port 1 could not be initialized.
Use ? for help.
monitor>
monitor>
monitor> ?
?                 this help message
address   [addr] set IP address of the PIX interface on which
                  the TFTP server resides
file      [name] set boot file name
gateway   [addr] set IP gateway
help              this help message
interface [num]   select TFTP interface
ping      <addr> send ICMP echo
reload            halt and reload system
server    [addr] set server IP address
tftp              TFTP download
timeout           TFTP timeout
trace             toggle packet tracing
monitor>
monitor> address ?
address 0.0.0.0
monitor>
monitor> interface 0
0: i8255X @ PCI(bus:0 dev:14 irq:10)
1: i8255X @ PCI(bus:0 dev:13 irq:11)

Using 0: i82557 @ PCI(bus:0 dev:14 irq:10), MAC: 0013.60e2.bbb6
monitor>
monitor> address 172.17.17.18 255.255.0.0
address 0.0.0.0

monitor> address 172.17.17.18
address 172.17.17.18
monitor>
monitor> gateway 172.17.17.17
gateway 172.17.17.17
monitor>
monitor>
monitor> ping 172.17.17.17   --- for testing purposes, no ping / no tftp;)
Sending 5, 100-byte 0xe1ab ICMP Echoes to 172.17.17.17, timeout is 4 seconds:
!!!!!
Success rate is 100 percent (5/5)
monitor>
monitor>
monitor> server 172.17.17.17
server 172.17.17.17
monitor>
monitor> file 8529-np70.bin
file 8529-np70.bin
monitor>
monitor>
monitor> tftp
tftp 8529-np70.bin@172.17.17.17 via 172.17.17.17.............................................................................................................................................................................................................................................................
Received 129024 bytes

Cisco PIX Security Appliance password tool (3.0) #0: Thu Jun 9 21:45:44 PDT 2005

Initializing flashfs...
flashfs[0]: 7 files, 3 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 16128000
flashfs[0]: Bytes used: 14300160
flashfs[0]: Bytes available: 1827840
flashfs[0]: Initialization complete.
Using the default startup configuration

Do you wish to erase the passwords? y/n [n]: y
The following lines will be removed from the configuration:
        enable password H75KO93BH/Ur8Ksg encrypted
        passwd H75KO93BH/Ur8Ksg encrypted
        aaa authentication enable console LOCAL
        aaa authentication ssh console LOCAL
        aaa authorization command LOCAL

Do you want to remove the commands listed above from the configuration? y/n [n] y
Passwords and aaa commands have been erased.

And so that's it - we have an access to enable mode and into config terminal on PIX-525 ASA Firewall.

New issue:
- one device is with Active/Active license and second with Active/Standby

Thursday, July 7, 2016

Tacacs+ Server for Cisco Devices Authentication

TACACS+ Server for Cisco Devices

(Linux Raspbian / Raspberry Pi)

PayozonLAB-RT01#test aaa group tacacs+

new-code
Sending password
User successfully authenticated

USER ATTRIBUTES

username             "user01"
reply-message        "Password: "
PayozonLAB-RT01#

PayozonLAB-RT01#
PayozonLAB-RT01#test aaa group tacacs+ payozon tacacs legacy
Attempting authentication test to server-group tacacs+ using tacacs+
User was successfully authenticated.

PayozonLAB-RT01#

And how to do it? In Raspi start terminal and install tacacs+

sudo apt install tacacs+
sudo service tacacs_plus status

sudo nano /etc/tacacs+/tac_plus.conf

Now we need to add auth_key, users and passwords - prepend the text below to the end of the file tac_plus.conf and comment all above:

# This is the key that clients have to use to access Tacacs+
key = test@Key123

# User - Basic Settings
user = root {
default service = permit
name = “Administrator”
login = cleartext admin
service = exec {
priv-lvl = 15
}
}

sudo service tacacs_plus restart

tail /var/log/tac_plus.acct

Then you can switch to your Cisco switch or router and test it!

test aaa group tacacs+ admin admin legacy

ssh -c aes256-cbc admin@172.16.255.103

Everythin' OK? Let's continue...

In global configuration mode issue the commands below:

aaa new-model
aaa authentication login default local group tacacs+
aaa authentication enable default group tacacs+ enable
aaa accounting commands 15 default
action-type start-stop
group tacacs+

tacacs-server host 192.168.15.62
tacacs-server key test@Key123

So, above is older method. The new one:

tacacs server TACACS+

address ipv4 192.168.1.38

timeout 15

aaa authentication login TACACS+ group tacacs+

aaa authentication password-prompt TACACS+Password:

aaa authentication attempts login 5

aaa authentication username-prompt TACACS+Username:

And the last begginer's task is to configure TACACS+ banner and password / user prompt.

(config)#aaa authentication banner X
Enter TEXT message. End with the character 'X'.
*****************************************************************
*                                                               *
*      PRIVATE PROPERTY -- YOU ARE MONITORED! LEAVE NOW!        *
* ------------------------------------------------------------- *
*    THIS COMPUTER SYSTEM, INCLUDING ALL RELATED EQUIPMENT,     *
*                 NETWORKS AND NETWORK DEVICES                  *
*           (SPECIFICALLY INCLUDING INTERNET ACCESS)            *
*   ARE PROVIDED ONLY FOR AUTHORIZED USE. USE OF THIS SYSTEM    *
* AUTHORIZED OR UNAUTHORIZED, CONSTITUTES CONSENT TO MONITORING *
*                                                               *
*    UNAUTHORIZED USE MAY SUBJECT YOU TO CRIMINAL PROSECUTION   *
* EVIDENCE OF UNAUTHORIZED USE COLLECTED DURING MONITORING MAY *
* BE USED FOR ADMINISTRATIVE, CRIMINAL OR OTHER ADVERSE ACTION *
*                                                               *
*    USE OF THIS SYSTEM CONSTITUTES CONSENT TO MONITORING.      *
*                                                               *
*****************************************************************

X
(config)#

-- for more secure usage use tac_pwd
to generate a DES encrypted password

-- in tac_plus.conf use
login = des 8L/6PsZWYZzjk

MagLab-phys-R01#test aaa group tacacs+ admin admin legacy
Attempting authentication test to server-group tacacs+ using tacacs+
User was successfully authenticated.

Networ-king