blog/ posts/ Configuring TACACS+NG and LDAPS authentication
← Configuring TACACS+NG using VRP RBAC role assignment | posts | Configuring TACACS+NG and LDAP authentication →
  1. Topology
  2. LDAP
    1. Goal
  3. LLDAP
    1. Generate key
    2. Enable LDAPS
    3. Full configuration
  4. TACACS+NG
    1. Enable LDAPS
    2. Full configuration
  5. Debugging
    1. Packet capture
  6. TACACS+NG
    1. Set outgoing TLS Version
    2. Full Config
  7. Verify
    1. Show TLSv1.3 cipher spec
    2. Show TLSv1.2 cipher spec
  8. See also
  9. References

This is a followup to previous GNS3 netlab Configuring TACACS+NG and LDAP authentication. The goal of the previous netlab was to move user credentials and group management to a LDAP server. The goal was achieved.

Reading the TACACS+NG best practices first entry to use TLS/DTLS wherever possible:

TLS/DTLS

  • Use TLS/DTLS wherever possible. tac_plus-ng support certificate based authentication, but also TLS pre-shared keys
  • TLS only provides authentication. Use a (possibly and most likely custom) MAVIS backend for certificate-based host details ...

So following this advice and preferring LDAPS over LDAP communication.

📗 Hint
It is a Best Practice to setup and operate LDAPS as the mandatory communication protocol.

But also at the same time:

📘 Note
It is a good idea to use clear test LDAP protocol as debugging tool in IP networking, to take sure the a given LDAP query or LDAP_FILTER setting works as configured, when not having LDAP admin access to the LDAP daemon, and to take sure LDAP PDU's arrive at destination as queried on the source.

The necessary information to setup a working LDAP GNS3 netlab are explained in the previous Configuring TACACS+NG and LDAP authentication blog entry. The goal of this GNS3 netlab will is the configuration process to use LDAPS as mandatory protocol to use between the TACACS+ daemon and the LDAP daemon.

Topology

Using the now ready setup and converged network topology from Configuring TACACS+NG and LDAP authentication:

network topology

IP topology of connected IP networks to router R1:

R1#sh ip int brie | e un
Interface              IP-Address      OK? Method Status                Protocol
Ethernet0/1            198.51.100.1    YES NVRAM  up                    up
Ethernet0/2            203.0.113.1     YES NVRAM  up                    up
Ethernet0/3            10.100.100.1    YES NVRAM  up                    up
Ethernet1/1            10.100.200.50   YES NVRAM  up                    up

Network is converged and ready to use.

LDAP

This is what goes over the wire between the TACACS+ daemon and the LDAP daemon. While TACACS+ is encrypted, the LDAP protocol packets are sent in clear text over the network:

tshark -r AAA-49_LDAP_capture.pcapng | head -n 58 | grep LDAP

Communication between the TACACS+ and LDAP daemons, notice the LDAP queries sent from TACACS+ to LDAP when user authentication is processed:

22  31.714209 10.100.200.49 → 198.51.100.10 LDAP 121 bindRequest(1) "cn=ro,ou=people,dc=example,dc=org" simple
25  31.826013 198.51.100.10 → 10.100.200.49 LDAP 80 bindResponse(1) success
27  31.831642 10.100.200.49 → 198.51.100.10 LDAP 128 searchRequest(2) "<ROOT>" baseObject
29  31.833534 198.51.100.10 → 10.100.200.49 LDAP 486 searchResEntry(2) "<ROOT>"
31  31.874651 198.51.100.10 → 10.100.200.49 LDAP 117 searchResDone(2) success  [1 result]
33  31.875629 10.100.200.49 → 198.51.100.10 LDAP 128 searchRequest(3) "<ROOT>" baseObject
34  31.876139 198.51.100.10 → 10.100.200.49 LDAP 486 searchResEntry(3) "<ROOT>"
36  31.917589 198.51.100.10 → 10.100.200.49 LDAP 117 searchResDone(3) success  [2 results]
38  31.919176 10.100.200.49 → 198.51.100.10 LDAP 285 searchRequest(4) "<ROOT>" baseObject
39  31.920130 198.51.100.10 → 10.100.200.49 LDAP 486 searchResEntry(4) "<ROOT>"
41  31.962013 198.51.100.10 → 10.100.200.49 LDAP 117 searchResDone(4) success  [3 results]
43  31.963626 10.100.200.49 → 198.51.100.10 LDAP 121 bindRequest(5) "cn=ro,ou=people,dc=example,dc=org" simple
45  32.049958 198.51.100.10 → 10.100.200.49 LDAP 80 bindResponse(5) success
46  32.050560 10.100.200.49 → 198.51.100.10 LDAP 285 searchRequest(6) "<ROOT>" baseObject
48  32.050973 198.51.100.10 → 10.100.200.49 LDAP 486 searchResEntry(6) "<ROOT>"
50  32.092408 198.51.100.10 → 10.100.200.49 LDAP 117 searchResDone(6) success  [4 results]
52  32.093175 10.100.200.49 → 198.51.100.10 LDAP 281 searchRequest(7) "dc=example,dc=org" wholeSubtree
53  32.096534 198.51.100.10 → 10.100.200.49 LDAP 164 searchResEntry(7) "uid=cisco,ou=people,dc=example,dc=org"
55  32.137449 198.51.100.10 → 10.100.200.49 LDAP 117 searchResDone(7) success  [5 results]
57  32.138189 10.100.200.49 → 198.51.100.10 LDAP 149 searchRequest(8) "cn=NOC,ou=groups,dc=example,dc=org" baseObject
58  32.139568 198.51.100.10 → 10.100.200.49 LDAP 111 searchResEntry(8) "cn=NOC,ou=groups,dc=example,dc=org"

Citation from about the LDAP protocol in IP networks.

Even in private networks you should configure LLDAP to communicate over HTTPS, otherwise passwords will be transmitted in plain text. Just using a self-signed certificate will drastically improve security.

Goal

Change LDAP to LDAPS as mandatory communication protocol for TACACS+NG and LLDAP daemon, by creating and using self signed certificate on the LDAP server side.

LLDAP

LDAPS uses certificate files to initiate encrypted communication. Generate keys and enable LDAPS in the configuration file.

Generate key

Setting the the subjectAltName is mandatory. Take sure the domain is listed, set the correct CN.

Necessary option|value settings overview:

  • subjectAltName - DNS:lldap.example.org
  • CN - lldap.example.org

Generate an SSL certificate for LLDAP daemon using the openssl command setting the options:

openssl req -x509 -nodes -newkey rsa:4096 -keyout key.pem -out cert.pem -sha256 -days 36500 -subj "/CN=lldap.example.org" -addext "subjectAltName = DNS:lldap.example.org"

Verify the generated *.pem files are in place and have proper file settings:

lldap [/opt/lldap]# ls -lah *.pem
-rw-r--r--    1 root     root        1.8K Jan 22 11:12 cert.pem
-rw-------    1 root     root        3.2K Jan 22 11:12 key.pem

With the generated certificates for the domain example.org , for the server or lldap.example.org, enable and configure LDAPS for LLDAP daemon.

Enable LDAPS

Edit the /opt/lldap/lldap_config.toml configuration file and add following lines enabling the LDAP server to have encrypted communication and transport.

[ldaps_options]
enabled = true
port = 636
cert_file = "cert.pem"
key_file = "key.pem"

Full configuration

Running LLDAP lldap_config.toml configuration with added LDAPS service:

#verbose = true
ldap_port = 389
ldap_host = "0.0.0.0"
http_port = 17170
http_url = "http://lldap.example.org"
jwt_secret = "QPK6m5l8iUSiHWNCZFXt"
ldap_base_dn = "dc=example,dc=org"
ldap_user_dn = "ldapadmin"
ldap_user_email = "ldapadmin@example.org"
ldap_user_pass = "ldapadmin"
database_url = "sqlite:///opt/lldap/users.db?mode=rwc"

[ldaps_options]
enabled = true
port = 636
cert_file = "cert.pem"
key_file = "key.pem"

Restart the lldap daemon. Verify the configured TCP/IP sockets 636 are bound:

ss -tlpn
State     Recv-Q    Send-Q       Local Address:Port        Peer Address:Port    Process                                                       
LISTEN    0         2048               0.0.0.0:17170            0.0.0.0:*        users:(("lldap",pid=2072,fd=12))                             
LISTEN    0         128                0.0.0.0:22               0.0.0.0:*        users:(("sshd",pid=2106,fd=6))                               
LISTEN    0         2048               0.0.0.0:636              0.0.0.0:*        users:(("lldap",pid=2072,fd=11))                             
LISTEN    0         2048               0.0.0.0:389              0.0.0.0:*        users:(("lldap",pid=2072,fd=10))

Everything is working on the LDAP server side. Running services are bound to all IPv4 running interfaces 0.0.0.0 only.

TACACS+NG

The changes are minimal on the TACACS+ daemon side.

Enable LDAPS

Configuration setting needs changing protocol from ldap to ldaps at and the TCP port in the LDAP_HOST variable to use LDAPS as communication protocol:

...
mavis module = external {
    # change ldap to ldaps, 
    # change the target TCP port to 636
    setenv LDAP_HOSTS = "ldaps://198.51.100.10:636"
    setenv LDAP_BASE = "dc=example,dc=org"
    setenv LDAP_USER = "cn=ro,ou=people,dc=example,dc=org"
    setenv LDAP_PASSWD = "readonly"
    exec = /usr/lib/mavis/mavis_tacplus-ng_ldap.pl
}

Everything else is as before. This forces the LDAPS protocol usage, without the possibility to fallback to LDAP protocol instead, which is the desired setting.

Full configuration

Example TACACS+ daemon with LDAPS only configured for tac_plus-ng:

#!/usr/local/sbin/tac_plus-ng

id = spawnd {
    listen = { port = 49 }
}

id = tac_plus-ng {

        #debug = AUTHEN AUTHOR MAVIS AV

    mavis module = external {
        # change ldap to ldaps, change the TCP port
        setenv LDAP_HOSTS = "ldaps://198.51.100.10:636"
        setenv LDAP_BASE = "dc=example,dc=org"
        setenv LDAP_USER = "cn=ro,ou=people,dc=example,dc=org"
        setenv LDAP_PASSWD = "readonly"
        exec = /usr/lib/mavis/mavis_tacplus-ng_ldap.pl
    }

    login backend = mavis
    user backend = mavis
    pap backend = mavis

    host IPv4 {
        address = 0.0.0.0/0
        key = "123-my_tacacs_key"
        welcome banner = "\n Welcome to TACACS+NG LDAPS MAVIS\n"
    }

    profile netadmin {
        script {
            if (service == shell) {
                if (cmd == "") {
                    set priv-lvl = 15
                    permit
                }
            }
        }
    }

    group NOC

    ruleset {
        rule {
            script {
                if (group == NOC) {
                    profile = netadmin
                    permit
                }
            }
        }
    }
}

Restart the daemon

rc-service tac_plus-ng restart

Debugging

Example cisco user authentication session send from node-100 to router R101 in below IP packet capture and tac_plus-ng debugging events

Packet capture

Authentication session to a router R101 initiated with the same user as above in the initial packet capture. 

tshark -r AAA-49_LDAPS_capture.pcapng

There is no LDAP protocol anymore involved. The TCP sessions between TACACS+ and LDAP are encrypted.

    1   0.000000 aa:bb:cc:00:03:11 → aa:bb:cc:00:03:11 LOOP 60 Reply
    2   6.007577 10.100.100.101 → 10.100.200.49 TCP 66 48489 → 49 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 SACK_PERM WS=4
    3   6.007774 10.100.200.49 → 10.100.100.101 TCP 66 49 → 48489 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 SACK_PERM WS=128
    4   6.007911 10.100.100.101 → 10.100.200.49 TCP 54 48489 → 49 [ACK] Seq=1 Ack=1 Win=131072 Len=0
    5   6.007940 10.100.100.101 → 10.100.200.49 TACACS+ 91 Q: Authentication
    6   6.008047 10.100.200.49 → 10.100.100.101 TCP 60 49 → 48489 [ACK] Seq=1 Ack=38 Win=64256 Len=0
    7   6.008171 10.100.200.49 → 10.100.100.101 TACACS+ 116 R: Authentication
    8   6.208274 10.100.100.101 → 10.100.200.49 TCP 54 48489 → 49 [ACK] Seq=38 Ack=63 Win=131008 Len=0
    9   9.939121 10.100.100.101 → 10.100.200.49 TACACS+ 76 Q: Authentication
   10   9.939433 10.100.200.49 → 10.100.100.101 TACACS+ 82 R: Authentication
   11  10.000742 aa:bb:cc:00:03:11 → aa:bb:cc:00:03:11 LOOP 60 Reply
   12  10.139836 10.100.100.101 → 10.100.200.49 TCP 54 48489 → 49 [ACK] Seq=60 Ack=91 Win=130980 Len=0
   13  13.180891 10.100.100.101 → 10.100.200.49 TACACS+ 79 Q: Authentication
   14  13.183996 10.100.200.49 → 198.51.100.10 TLSv1.2 143 Application Data
   15  13.184289 198.51.100.10 → 10.100.200.49 TCP 66 636 → 58562 [ACK] Seq=1 Ack=78 Win=496 Len=0 TSval=2699785083 TSecr=3703729946
   16  13.221470 10.100.200.49 → 10.100.100.101 TCP 60 49 → 48489 [ACK] Seq=91 Ack=85 Win=64256 Len=0
   17  13.248932 198.51.100.10 → 10.100.200.49 TLSv1.2 102 Application Data
   18  13.249135 10.100.200.49 → 198.51.100.10 TCP 66 58562 → 636 [ACK] Seq=78 Ack=37 Win=528 Len=0 TSval=3703730011 TSecr=2699785147
   19  13.249640 10.100.200.49 → 198.51.100.10 TLSv1.2 303 Application Data
   20  13.249889 198.51.100.10 → 10.100.200.49 TCP 66 636 → 58562 [ACK] Seq=37 Ack=315 Win=495 Len=0 TSval=2699785148 TSecr=3703730012
   21  13.251261 198.51.100.10 → 10.100.200.49 TLSv1.2 186 Application Data
   22  13.292373 10.100.200.49 → 198.51.100.10 TCP 66 58562 → 636 [ACK] Seq=315 Ack=157 Win=528 Len=0 TSval=3703730055 TSecr=2699785149
   23  13.292741 198.51.100.10 → 10.100.200.49 TLSv1.2 139 Application Data
   24  13.292898 10.100.200.49 → 198.51.100.10 TCP 66 58562 → 636 [ACK] Seq=315 Ack=230 Win=528 Len=0 TSval=3703730055 TSecr=2699785191
   25  13.293246 10.100.200.49 → 198.51.100.10 TLSv1.2 171 Application Data
   26  13.294344 198.51.100.10 → 10.100.200.49 TLSv1.2 133 Application Data
   27  13.335433 10.100.200.49 → 198.51.100.10 TCP 66 58562 → 636 [ACK] Seq=420 Ack=297 Win=528 Len=0 TSval=3703730098 TSecr=2699785192
   28  13.335847 198.51.100.10 → 10.100.200.49 TLSv1.2 139 Application Data
   29  13.335957 10.100.200.49 → 198.51.100.10 TCP 66 58562 → 636 [ACK] Seq=420 Ack=370 Win=528 Len=0 TSval=3703730098 TSecr=2699785234
   30  13.336334 10.100.200.49 → 198.51.100.10 TLSv1.2 147 Application Data
   31  13.377375 198.51.100.10 → 10.100.200.49 TCP 66 636 → 58562 [ACK] Seq=370 Ack=501 Win=496 Len=0 TSval=2699785276 TSecr=3703730098
   32  13.400532 198.51.100.10 → 10.100.200.49 TLSv1.2 102 Application Data
   33  13.401260 10.100.200.49 → 10.100.100.101 TACACS+ 72 R: Authentication
   34  13.401692 10.100.100.101 → 10.100.200.49 TCP 54 48489 → 49 [FIN, PSH, ACK] Seq=85 Ack=109 Win=130964 Len=0
   35  13.401848 10.100.100.101 → 10.100.200.49 TCP 66 41772 → 49 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 SACK_PERM WS=4
   36  13.403294 10.100.200.49 → 10.100.100.101 TCP 66 49 → 41772 [SYN, ACK] Seq=0 Ack=1 Win=64240 Len=0 MSS=1460 SACK_PERM WS=128
   37  13.403340 10.100.200.49 → 10.100.100.101 TCP 60 49 → 48489 [FIN, ACK] Seq=109 Ack=86 Win=64256 Len=0
   38  13.403469 10.100.100.101 → 10.100.200.49 TCP 54 41772 → 49 [ACK] Seq=1 Ack=1 Win=131072 Len=0
   39  13.403482 10.100.100.101 → 10.100.200.49 TCP 54 48489 → 49 [ACK] Seq=86 Ack=110 Win=130964 Len=0
   40  13.403517 10.100.100.101 → 10.100.200.49 TACACS+ 115 Q: Authorization
   41  13.403626 10.100.200.49 → 10.100.100.101 TCP 60 49 → 41772 [ACK] Seq=1 Ack=62 Win=64256 Len=0
   42  13.405316 10.100.200.49 → 10.100.100.101 TACACS+ 84 R: Authorization
   43  13.405606 10.100.100.101 → 10.100.200.49 TCP 54 41772 → 49 [FIN, PSH, ACK] Seq=62 Ack=31 Win=131040 Len=0
   44  13.406178 10.100.200.49 → 10.100.100.101 TCP 60 49 → 41772 [FIN, ACK] Seq=31 Ack=63 Win=64256 Len=0
   45  13.406348 10.100.100.101 → 10.100.200.49 TCP 54 41772 → 49 [ACK] Seq=63 Ack=32 Win=131040 Len=0
   46  13.441413 10.100.200.49 → 198.51.100.10 TCP 66 58562 → 636 [ACK] Seq=501 Ack=406 Win=528 Len=0 TSval=3703730204 TSecr=2699785299

No LDAP network packets anymore in the output, communication is encrypted using LDAPS.

TACACS+NG

Running the TACACS+ daemon with enabled debug debug = AUTHEN AUTHOR MAVIS AV debug options, to verify the LDAPS communication is working using the MAVIS module:

AAA-49 [/etc/tac_plus-ng]# tac_plus-ng -1 -f tac_plus-ng.cfg
2042: 11:34:16.467 0/35087974: 10.100.100.101 authen: hdr->seq_no: 1
2042: 11:34:18.944 0/35087974: 10.100.100.101 authen: hdr->seq_no: 3
2042: 11:34:18.944 0/35087974: 10.100.100.101 looking for user cisco realm default
2042: 11:34:18.944 0/35087974: 10.100.100.101 user lookup failed
2042: 11:34:21.378 0/35087974: 10.100.100.101 authen: hdr->seq_no: 5
2042: 11:34:21.378 0/35087974: 10.100.100.101 looking for user cisco realm default
2042: 11:34:21.378 0/35087974: 10.100.100.101 user lookup failed
2042: 11:34:21.378 0/35087974: 10.100.100.101 looking for user cisco in MAVIS backend
2042: 11:34:21.966 0/35087974: 10.100.100.101 result for user cisco is ACK [587 ms]
2042: 11:34:21.966 0/35087974: 10.100.100.101 looking for user cisco realm default
2042: 11:34:21.966 0/35087974: 10.100.100.101 user lookup succeded
2042: 11:34:21.966 0/35087974: 10.100.100.101 shell login for 'cisco' from 203.0.113.100 on tty2 succeeded (profile=netadmin)
2042: 11:34:21.968 1/da332bbb: 10.100.100.101 Start authorization request
2042: 11:34:21.968 1/da332bbb: 10.100.100.101 user 'cisco' found
2042: 11:34:21.968 1/da332bbb: 10.100.100.101 nas:service=shell (passed thru)
2042: 11:34:21.968 1/da332bbb: 10.100.100.101 nas:cmd* (passed thru)
2042: 11:34:21.968 1/da332bbb: 10.100.100.101 nas:absent srv:priv-lvl=15 -> add priv-lvl=15 (k)
2042: 11:34:21.968 1/da332bbb: 10.100.100.101 added 1 args
2042: 11:35:02.371 2/3ee47212: 10.100.100.101 authen: hdr->seq_no: 1
2042: 11:35:06.302 2/3ee47212: 10.100.100.101 authen: hdr->seq_no: 3
2042: 11:35:06.302 2/3ee47212: 10.100.100.101 looking for user cisco realm default
2042: 11:35:06.302 2/3ee47212: 10.100.100.101 user lookup succeded
2042: 11:35:09.544 2/3ee47212: 10.100.100.101 authen: hdr->seq_no: 5
2042: 11:35:09.544 2/3ee47212: 10.100.100.101 looking for user cisco realm default
2042: 11:35:09.544 2/3ee47212: 10.100.100.101 user lookup succeded
2042: 11:35:09.544 2/3ee47212: 10.100.100.101 looking for user cisco in MAVIS backend
2042: 11:35:09.764 2/3ee47212: 10.100.100.101 result for user cisco is ACK [219 ms]
2042: 11:35:09.764 2/3ee47212: 10.100.100.101 looking for user cisco realm default
2042: 11:35:09.764 2/3ee47212: 10.100.100.101 user lookup succeded
2042: 11:35:09.764 2/3ee47212: 10.100.100.101 shell login for 'cisco' from 203.0.113.100 on tty2 succeeded (profile=netadmin)
2042: 11:35:09.766 3/4b9b9269: 10.100.100.101 Start authorization request
2042: 11:35:09.766 3/4b9b9269: 10.100.100.101 user 'cisco' found
2042: 11:35:09.766 3/4b9b9269: 10.100.100.101 nas:service=shell (passed thru)
2042: 11:35:09.766 3/4b9b9269: 10.100.100.101 nas:cmd* (passed thru)
2042: 11:35:09.766 3/4b9b9269: 10.100.100.101 nas:absent srv:priv-lvl=15 -> add priv-lvl=15 (k)
2042: 11:35:09.766 3/4b9b9269: 10.100.100.101 added 1 args

TACACS+NG with LDAPS configuration accomplished. Verified encryption is enabled and used for communication between the LDAP daemon and the TACACS+ daemon.

It would be interesting on how to configure or force the TLS v1.3 instead of TLSv1.2.

TLSv1.2 143 Application Data

And if the change to use TLS v1.3 is can be configured simply or if it is involves a big cryptography and certificate generation and roll out to each client. And many more dependencies like a working DNS (of course), working NTP infrastructure.

But for the most critical part the configuration of LDAPS is easy to enable and configure, on both sides.

Set outgoing TLS Version

The specific output above, that one of the LDAP communication partners (TACACS+ or LDAP) chose TLS v1.2 for encryption is not a optimal setting. Without going into much details, both communication partners SHOULD use uniform encryption layer or same library, or stick to the current best available method in given environement.

One packet capture at the TACACS+ server shows the TLSv1.2 communication:

tshark -r AAA-49_LDAPS_capture.pcapng | head -n 58 | grep TLS
   14  13.183996 10.100.200.49 → 198.51.100.10 TLSv1.2 143 Application Data
   17  13.248932 198.51.100.10 → 10.100.200.49 TLSv1.2 102 Application Data
   19  13.249640 10.100.200.49 → 198.51.100.10 TLSv1.2 303 Application Data

Different packet capture at the LDAP server revealed that TLSv1.2 was chosen too:

tshark -r LLDAP-10_eth0_LDAPS_TLSv1.2.pcapng | grep TLS | head
    2   5.127160 10.100.200.49 → 198.51.100.10 TLSv1.2 143 Application Data
    4   5.184777 198.51.100.10 → 10.100.200.49 TLSv1.2 102 Application Data
    6   5.185487 10.100.200.49 → 198.51.100.10 TLSv1.2 301 Application Data

Most probably during negotiation when the secured TCP/IP session from the LDAP client to the LDAP server is initiated.

Regarding LDAPS the official TACACS+NG documentation states in section 5.1.LDAP Backends

TLS_OPTIONS - Extra options for use with LDAPS or start_tls, in Perl hash syntax.

  • Default: unset

  • Example: "sslversion => 'tlsv1_3'"

Configure TACACS+NG to use TLSv1.3 instead of the negiotiatied TLSv1.2 version. Configure the TLS_OPTIONS environement variable and set to sslversion => 'tlsv1_3'.

...
mavis module = external {
    # set TLS version
    setenv TLS_OPTIONS = "sslversion => 'tlsv1_3'"
    # set to ldaps, change the TCP port
    setenv LDAP_HOSTS = "ldaps://198.51.100.10:636"
    setenv LDAP_BASE = "dc=example,dc=org"
    setenv LDAP_USER = "cn=ro,ou=people,dc=example,dc=org"
    setenv LDAP_PASSWD = "readonly"
    exec = /usr/lib/mavis/mavis_tacplus-ng_ldap.pl
}

Full Config

The full configuration for the given example, with the specified TLS version to use:

#!/usr/local/sbin/tac_plus-ng

id = spawnd {
    listen = { port = 49 }
}

id = tac_plus-ng {

        #debug = AUTHEN AUTHOR MAVIS AV

    mavis module = external {
        # set TLS version
        setenv TLS_OPTIONS = "sslversion => 'tlsv1_3'"
        # set ldaps, set TCP port
        setenv LDAP_HOSTS = "ldaps://198.51.100.10:636"
        setenv LDAP_BASE = "dc=example,dc=org"
        setenv LDAP_USER = "cn=ro,ou=people,dc=example,dc=org"
        setenv LDAP_PASSWD = "readonly"
        exec = /usr/lib/mavis/mavis_tacplus-ng_ldap.pl
    }

    login backend = mavis
    user backend = mavis
    pap backend = mavis

    host IPv4 {
        address = 0.0.0.0/0
        key = "123-my_tacacs_key"
        welcome banner = "\n Welcome to TACACS+ LDAPS MAVIS \n\n"
    }

    profile netadmin {
        script {
            if (service == shell) {
                if (cmd == "") {
                    set priv-lvl = 15
                    permit
                }
            }
        }
    }

    group NOC

    ruleset {
        rule {
            script {
                if (group == NOC) {
                    profile = netadmin
                    permit
                }
            }
        }
    }
}

After applying changes restart the TACACS+ daemon, to changes take effect:

rc-service tac_plus-ng restart

This is the resulting packet capture as the setting has been changed to to use tlsv1.3 version, and the TACACS+ daemon has been restarted. Both communication partners initiate a new TCP session and notifying a change in cipher spec(ification).:

tshark -r LLDAP-10_eth0_LDAPS_TLSv1.2.pcapng | grep TLS
    2   5.127160 10.100.200.49 → 198.51.100.10 TLSv1.2 143 Application Data
    4   5.184777 198.51.100.10 → 10.100.200.49 TLSv1.2 102 Application Data
    6   5.185487 10.100.200.49 → 198.51.100.10 TLSv1.2 301 Application Data
    8   5.186682 198.51.100.10 → 10.100.200.49 TLSv1.2 228 Application Data
   10   5.227348 198.51.100.10 → 10.100.200.49 TLSv1.2 139 Application Data
   12   5.227814 10.100.200.49 → 198.51.100.10 TLSv1.2 175 Application Data
   13   5.228709 198.51.100.10 → 10.100.200.49 TLSv1.2 137 Application Data
   15   5.269338 198.51.100.10 → 10.100.200.49 TLSv1.2 139 Application Data
   17   5.269817 10.100.200.49 → 198.51.100.10 TLSv1.2 173 Application Data
   18   5.270742 198.51.100.10 → 10.100.200.49 TLSv1.2 135 Application Data
   20   5.311287 198.51.100.10 → 10.100.200.49 TLSv1.2 139 Application Data
   22   5.311775 10.100.200.49 → 198.51.100.10 TLSv1.2 146 Application Data
   24   5.367249 198.51.100.10 → 10.100.200.49 TLSv1.2 102 Application Data
   61 214.953171 10.100.200.49 → 198.51.100.10 TLSv1.2 142 Client Hello
   63 214.958686 198.51.100.10 → 10.100.200.49 TLSv1.3 1514 Server Hello, Change Cipher Spec, Application Data
   64 214.958699 198.51.100.10 → 10.100.200.49 TLSv1.3 771 Application Data, Application Data, Application Data
   66 214.959539 10.100.200.49 → 198.51.100.10 TLSv1.3 146 Change Cipher Spec, Application Data
   67 214.959813 198.51.100.10 → 10.100.200.49 TLSv1.3 169 Application Data
   68 214.960148 10.100.200.49 → 198.51.100.10 TLSv1.3 143 Application Data
   70 215.015544 198.51.100.10 → 10.100.200.49 TLSv1.3 102 Application Data

Verify

The packet capture shows the TACACS+ server sends encrypted messages using the TLS v1.3 specification:

tshark -r LLDAP-10_eth0_LDAPS_TLSv1.3.pcapng| grep TLS
    7  17.455269 10.100.200.49 → 198.51.100.10 TLSv1.2 142 Client Hello
    9  17.461743 198.51.100.10 → 10.100.200.49 TLSv1.3 1514 Server Hello, Change Cipher Spec, Application Data
   10  17.461758 198.51.100.10 → 10.100.200.49 TLSv1.3 771 Application Data, Application Data, Application Data
   12  17.462852 10.100.200.49 → 198.51.100.10 TLSv1.3 146 Change Cipher Spec, Application Data
   13  17.463124 198.51.100.10 → 10.100.200.49 TLSv1.3 169 Application Data
   14  17.463531 10.100.200.49 → 198.51.100.10 TLSv1.3 143 Application Data
   16  17.529338 198.51.100.10 → 10.100.200.49 TLSv1.3 102 Application Data
   17  17.533333 10.100.200.49 → 198.51.100.10 TLSv1.3 150 Application Data
   19  17.533666 198.51.100.10 → 10.100.200.49 TLSv1.3 508 Application Data
   21  17.575109 198.51.100.10 → 10.100.200.49 TLSv1.3 139 Application Data
   23  17.575794 10.100.200.49 → 198.51.100.10 TLSv1.3 150 Application Data
   24  17.576050 198.51.100.10 → 10.100.200.49 TLSv1.3 508 Application Data
 ...
 1094 8589.284125 198.51.100.10 → 10.100.200.49 TLSv1.3 135 Application Data
 1096 8589.326060 198.51.100.10 → 10.100.200.49 TLSv1.3 139 Application Data
 1098 8589.328357 10.100.200.49 → 198.51.100.10 TLSv1.3 147 Application Data
 1100 8589.422954 198.51.100.10 → 10.100.200.49 TLSv1.3 102 Application Data

Show TLSv1.3 cipher spec

Now what is the Cipher Specification that has changed. Use the openssl command tho show the TLSv1.3 specification

Ciphers used when TLSv1.3 is set as default:

user % openssl ciphers -s -tls1_3 -v

TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEA

Show TLSv1.2 cipher spec

Ciphers used when TLSv1.2 is set as default, Use the openssl command to show the specification:

user % openssl ciphers -s -tls1_2 -v

ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD DHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=DH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384 ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384 DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256 ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256 ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256 DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256 ECDHE-ECDSA-AES256-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA1 ECDHE-RSA-AES256-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA1 DHE-RSA-AES256-SHA SSLv3 Kx=DH Au=RSA Enc=AES(256) Mac=SHA1 ECDHE-ECDSA-AES128-SHA TLSv1 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA1 ECDHE-RSA-AES128-SHA TLSv1 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA1 DHE-RSA-AES128-SHA SSLv3 Kx=DH Au=RSA Enc=AES(128) Mac=SHA1 AES256-GCM-SHA384 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(256) Mac=AEAD AES128-GCM-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AESGCM(128) Mac=AEAD AES256-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA256 AES128-SHA256 TLSv1.2 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA256 AES256-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(256) Mac=SHA1 AES128-SHA SSLv3 Kx=RSA Au=RSA Enc=AES(128) Mac=SHA1

See also

In the case you miss some configuration specifics, please read the prerequisite netlab about LDAP and TACACS+ setup:

References