A TACACS+ server that allows authorization and authentication via net
on remote access servers: Authenticate users, authorize commands and log
accounting information.
Version 4 has improved features and bugfixes over the older 2.x versions.
Improved features among others and bugfixes: Microsoft CHAP support.
To enable MSCHAP you need to optain a key from Microsoft, see the FAQ
section in the users guide. Therefore this isn't enabled by default.
Cisco, the original developers, have stopped tac_plus development around
F4.0.4. There are different versions based on Cisco tac_plus, this is the
version from Shrubbery Networks.
See also: https://www.shrubbery.net/tac_plus
===> The following configuration options are available for tac_plus-F4.0.4.32_1:
DOCS=on: Build and/or install documentation
===> Use 'make config' to modify these settings
net/tac_plus4: Update to F4.0.4.32
Changes since .28:
- Fix buffer length argument to ntop() - Muhammad Muquit
- Fix two missing free()s
- Fix segfault from incorrect pointer returned from value(). Reported
here:
http://www.shrubbery.net/pipermail/tac_plus/2014-January/001384.html
- update autoconf bits for autoconf 2.69
- put tac_plus daemon in sbin, where it ought to be
- fix hdr->datalength handling in dump_nas_pak()
- add -m option to specify the client listen queue max and increase
the default to 64 if the O/S does not define SOMAXCONN
- fix config.h include syntax - David M. Syzdek
(Only the first 15 lines of the commit message are shown above )
net/tac_plus4: Be explicit about the runtime user
It occurred to me that the tacacs user is set only at build time. So,
if someone assigned a different uid to their runtime tacacs user, the
daemon would, by default, run under uid 559. So, add a default
"-U tacacs" to the flags.
While here, fix a typo in the man page.
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
net: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ports@c0decafe.net>
* Aaron Dalton <aaron@FreeBSD.org>
* Aaron Straup Cope <ascope@cpan.org>
* Aaron Zauner <az_mail@gmx.at>
* Adam Jette <jettea46@yahoo.com>
* Adam Weinberger <adamw@FreeBSD.org>
* Alan Eldridge <alane@geeksrus.net>
* Alex Bakhtin <Alex.Bakhtin@gmail.com>
* Alex Deiter <Alex.Deiter@Gmail.COM>
* Alex Dupre <ale@FreeBSD.org>
* Alex Dupre <sysadmin@alexdupre.com>
(Only the first 15 lines of the commit message are shown above )
*/*: Remove redundant '-[0-9]*' from CONFLICTS
The conflict checks compare the patterns first against the package
names without version (as reported by "pkg query "%n"), then - if
there was no match - agsinst the full package names including the
version (as reported by "pkg query "%n-%v").
Many CONFLICTS definitions used patterns like "bash-[0-9]*" to filter
for the bash package in any version. But that pattern is functionally
identical with just "bash".
Approved by: portmgr (blanket)
- Update tac_plus4 to 4.0.4.28
- Regenerate patches to make portlint happy
- Other minor changes to Makefile for portlint happiness
- Updates the description to reflect a bit more the current state:
- The original FTP site from Cisco isn't reachable anymore, nor
is 2.x in the ports tree these days.
- Update/add the URL, though the one from Cisco still works, but
this is the version from Shrubbery Networks. (there are others around)
- Add a pkg-message
PR: 204683
Submitted by: Mathieu Simon <freebsd@simweb.ch>
- Update tac_plus4 to 4.0.4.28
- Regenerate patches to make portlint happy
- Other minor changes to Makefile for portlint happiness
- Updates the description to reflect a bit more the current state:
- The original FTP site from Cisco isn't reachable anymore, nor
is 2.x in the ports tree these days.
- Update/add the URL, though the one from Cisco still works, but
this is the version from Shrubbery Networks. (there are others around)
- Add a pkg-message
PR: 204683
Submitted by: Mathieu Simon <freebsd@simweb.ch>
Support LIBS like LDFLAGS.
- Add LIBS="${LIBS}" to MAKE_ENV and CONFIGURE_ENV.
- Add an option helper for LIBS.
- Adjust all ports that already use LIBS. Also remove references to
PTHREAD_CFLAGS and PTHREAD_LIBS while here.
- Some ports did not support having a LIBS environment variable and
required additional patches.
Somewhat simplified a linker command line looks like:
${CC} ${src_LDFLAGS} ${LDFLAGS} ${src_LIBS} ${LIBS}
where src_LDFLAGS and src_LIBS are controlled by upstream and LDFLAGS and
LIBS can be controlled by us. If possible -L and -l flags need to be
(Only the first 15 lines of the commit message are shown above )
* Add STAGE support
* Use the USERS/GROUPS framework to create the tacacs user
* Apparently, MAKE_JOB_UNSAFE is needed on i386 as well as amd64
PR: 182616
Submitted by: ohauer
Convert USE_BISON to USES= bison
It brings bison as a build dependency in case it is set the following way:
USES= bison or USES= bison:build
it brings bison as a run dependency in case it is set the following way:
USES= bison:run
it brings bison both as a run and build dependency in case it the set the
following way:
USES= bison:both
While here trim some headers
Convert some USE_GNOME= gnomehack to USES= pathfix
In the rc.d scripts, change assignments to rcvar to use the
literal name_enable wherever possible, and ${name}_enable
when it's not, to prepare for the demise of set_rcvar().
In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
The vast majority of pkg-descr files had the following format when they
had both lines:
Author: ...
WWW: ....
So standardize on that, and move them to the end of the file when necessary.
Also fix some more whitespace, and remove more "signature tags" of varying
forms, like -- name, etc.
s/AUTHOR/Author/
A few other various formatting issues
Update to F4.0.4.18, and add support for TACACS+ profiles to the rc.d
scripts.
PR: 134768 (profile support)
Submitted by: Ryan T.Dean <rtdean@cytherianage.net> (profile support)
Update CONFIGURE_ARGS for how we pass CONFIGURE_TARGET to configure script.
Specifically, newer autoconf (> 2.13) has different semantic of the
configure target. In short, one should use --build=CONFIGURE_TARGET
instead of CONFIGURE_TARGET directly. Otherwise, you will get a warning
and the old semantic may be removed in later autoconf releases.
To workaround this issue, many ports hack the CONFIGURE_TARGET variable
so that it contains the ``--build='' prefix.
To solve this issue, under the fact that some ports still have
configure script generated by the old autoconf, we use runtime detection
in the do-configure target so that the proper argument can be used.
Changes to Mk/*:
- Add runtime detection magic in bsd.port.mk
(Only the first 15 lines of the commit message are shown above )
Update to F4.0.4.14.
* Add notes about PAM to the user guide and tac_plus.conf(5)
* Log login failures with the username, NAS address and NAS tty
* ACLs were not applied through the default authentication
(ie: user=DEFAULT) path
* Update to F4.0.4.13
* Configure tac_plus to run as the user tacacs after starting up [1]
* Convert to USE_RC_SUBR
Requested by: Ryan Steinmetz <rpsfa@rit.edu>
Remove the FreeBSD KEYWORD from all rc.d scripts where it appears.
We have not checked for this KEYWORD for a long time now, so this
is a complete noop, and thus no PORTREVISION bump. Removing it at
this point is mostly for pedantic reasons, and partly to avoid
perpetuating this anachronism by copy and paste to future scripts.
Update to F4.0.4.8.
* if -B is used, add the bind address in the PID filename - from Ian Dickinson
* "acl" is an AV pair for service exec. Within service attribute
parsing, do not parse "acl" as the acl (or connection ACL) keyword.
This is a hack; the parser is rather lame - noted by Bryce Kahle
* fix md4 for LP64
* do not accept skey keywords unless compiled with skey support
* fix skey enable password type - bit from Ed Ravin
* skey prompt ("challenge") is "S/Key challenge", not "Password"
* make "daemon" the default syslog facility and add a syslog config
statement
* add support for user authentication via PAM
Update to F4.0.4.7. Code changes in this release include:
* Conversion to autofoo
* Man pahe improvements
* MD5 fixes for 64-bit platforms
* generated_password has been renamed to tac_pwd
* A tac_plus.config.5 man page has been added
* User-specific enable password support
Port changes in this release include:
* Default IOS version has been changed from 11.x to 12.x
* tac_plus.sh script has been converted to rcNG
* PORTDOCS is properly respected
* Portlint fixes
Install the generate_passwd program mentioned in the users guide. This tool
can be used to generate DES passwords for use in tac_plus.conf.
Submitted by: John <strgout@unixjunkie.com>
From Sergey: "Using tacacs I found that ckfinger() function from maxsess.c
module returns wrong count of current sessions for users with "maxsess"
parameter established in tac_plus.conf. It happens if Cisco access server
works with IOS v 12.x. On the other hand ckfinger() works well with IOS v
11.x Here are patches for both maxsess.c and port's Makefile to fix this
problem (but it is just workaround, ckfinger() should be fully rewritten)."
From me: changed variable name by prepending string "TAC_", so that tacacs+
ports variables follow an unique scheme. Please note: this doesn't compile
with the new TAC_IOS_VERSION variable if you have CFLAGS redefined in
/etc/make.conf as: CFLAGS=-pipe -O (or whatever) You have to use
CFLAGS+=-pipe -O (or whatever) Mailed to -developers. Am really not sure,
what's the culprit here. Fact is, that a part of CFLAGS get lost when
compiling the port, if you redefine CFLAGS in /etc/make.conf without the "+"
sign ... I personally removed my CFLAGS define in /etc/make.conf as it
defaults to -pipe -O, which is fine for me.
From Sergey: "The tac_plus user guide says that when passwd(5) file is used
for user authentication, the expiry date checks against shell field of
password file. Maybe it is OK for custom passwd files, but not for system
password file.
- update from F4.0.3 to F4.0.4 - contains security fix Damir Rajnovic
<gaus@CISCO.COM> on bugtraq: "We updated our unsupported version of TACACS+
server so it is no longer vulnerable to oversized T+ packets." - took
again maintainership of port, actually I never wanted to quit was a committ
failure when using port submission from PR
As threatened on freebsd-ports: all startup scripts know about the two options
`start' and `stop' now (unless I have forgotten any). This allows us to call
the scripts from /etc/rc.shutdown with the correct option.
