Cisco Tacacs+ command accounting to Mysql Db

August 3, 2012

Following this post what was left was my discomfort that cisco didn’t provide a way to log the commands send to the switch using radius accounting, but one had to use only tacacs+. As I have written there:

In the accounting section Cisco unfortunately (READ: WHY DEAR GOD, WHY??) doesn’t support sending each command a user types to RADIUS, but only for TACACS+, so the accounting part is at least handicapped.

So I was looking for a solution to the Internet. I didn’t find anything that could just fit it so I try to code my own version.

The first good thing is that tacacs+ was an open standard, so I didn;t have to figure out the protocol. I was thinking of implementing a small program that was providing only the needed functionality but thankfully there are opensource tacacs+ implementations (the most updated seemed this) where I can base my work. So I grabbed the latest version and I started modifying it. The result can be find in this diff.

A few words about installing and using it. In order to compile the MySQL support you need to add the –with-mysql flag during to configure script. After the compile finishes successfully, the next change needed is in the configuration file. In order to support the logging to mysql you need to add the line:

accounting acctdb = mysql://username:password@Host/Database/Table

If the password contains a @ you can close the password into single quotes so that the parsing still works. The corresponding line becomes like this:

accounting acctdb = mysql://username:'p@ssword'@Host/Database/Table

The way it is implemented right now, the database schema used is almost the same as the previous post, with a small addition to accommodate the command logging. The one used is this:

CREATE TABLE `Accounting` (
  `Id` bigint(21) NOT NULL auto_increment,
  `UniqueSessionId` varchar(50) NOT NULL default '',
  `AcctSessionId` varchar(50) NOT NULL default '',
  `UserName` varchar(100) NOT NULL default '',
  `CallingStationId` varchar(100) NOT NULL default '',
  `NASIPAddress` varchar(16) NOT NULL default '',
  `NASPort` int(10) unsigned NOT NULL default '0',
  `NASPortId` varchar(16) NOT NULL default '',
  `NASPortType` varchar(50) NOT NULL default '',
  `TimestampAccessStart` datetime default NULL,
  `TimestampAccessStop` datetime default NULL,
  `AcctSessionTime` int(10) unsigned NOT NULL default '0',
  `AcctTerminateCause` varchar(100) NOT NULL default '',
  `Command` text,
  PRIMARY KEY  (`Id`),
  KEY `UniqueSessionId` (`UniqueSessionId`,`AcctSessionId`,`UserName`),
  KEY `UserName` (`UserName`,`TimestampAccessStart`),
  KEY `NAS` (`NASIPAddress`,`NASPort`,`TimestampAccessStart`),
  KEY `CallingStationId` (`CallingStationId`,`TimestampAccessStart`)
) ENGINE=MyISAM DEFAULT CHARSET=greek

And finally the needed lines for the cisco configuration

aaa accounting commands 15 default start-stop group tacacs+

tacacs server test-tacacs
 address ipv4 xxx.xxx.xxx.xxx
 key secret
 port yyyy

The biggest part of the patch is for the autoconf configuration, and if there are any problems please excuse my poor autotools knowledge. (I was struggling with them for first time). The patch will be sent upstream, and hopefully it will be included in future tacacs+ releases. For any problem/issues/suggestions you can drop a comment.

Advertisements

One Response to “Cisco Tacacs+ command accounting to Mysql Db”

  1. saint Says:

    Fri Nov 14 11:10:46 2014 [9956]: db_get_host: got (tercesym)
    Fri Nov 14 11:10:46 2014 [9956]: Error send_authen_error: : Invalid AUTHEN/START packet (check keys)
    Fri Nov 14 11:10:46 2014 [9956]: exit status=0
    Fri Nov 14 11:10:46 2014 [9957]: db_get_host: got (tercesym)
    Fri Nov 14 11:10:47 2014 [9957]: Start accounting request
    Fri Nov 14 11:10:47 2014 [9957]: exit status=0

    My authentication is failing. I am trying to login using a router


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: