HOWTO: enable linux bash NX-OS

If you recalled my ASR unix shell  support

http://socpuppet.blogspot.com/2013/10/tip-how-to-gain-shell-in-ios-xr.html

With in the NX-OS  it also supports linux bash shell. It's a linux host after all  and has a limited access for linux shells and commands.

1st you need to enable the bash feature  { feature bash-shell } from config mode.


2nd, you have a restrict access for various unix commands by using the run via  the run bash  +command or by just  running a full bash shell via  run bash

e,g


run bash ls

or

run bash 

examples

enjoy


Ken
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

Automation backups F5 with bash & tmsh and GNU's gpg ( pgp )

Here in this current role ,  we use F5-LTMs. As you know or should know, the F5 appliances are running  linux currently ( previously they ran NetBSD ). If you have advance console access, you can do just about anything and everything in a  linux bash shell.

Here's a simple script that can be used on the appliance that I'm sharing &  that does the following;

1: builds a archive  ucs type file that's compressed  ( UserConfigurationSet )

2:  symmetrical encrypt the file using a static passphrase and with GNU's gpg

You can run this commands as a crontab  job and even scp, ftp or even  get creative push it via  a HTTP POST and curl to a upload site since the file is encrypted.

e,g

curl  -H "X_F5: backup "  -X POST -d @backupfilename  http://myusername:mypassword@ftp1.socpuppets.com/backups/ltms

Here's the backup script contents and execution.

Enjoy.


Ken Felix
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

PCNSE 7 exam is ready and available

Palo has PCNSE7  exam ready now thru pearson VUE.

https://www8.pearsonvue.com/testtaker/registration/ExamSeriesDetailPage/PALOALTO/713765

I'm  going to  take my very  1st stab at this  exam in mid-April.  Very little study materials exist for the exam, so you need to really look at the exam objectives.



https://www.paloaltonetworks.com/services/education

Ken Felix
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

Controlling fortigate cisco ACS 5.8 tacacs+ access profiles

To pass access profiles with the cisco ACS  you need to craft custom attributes for tacacs. The tacacs attributes should match a local define accprofile.

The profiles are used only after a ACCEPT from a success authentication. This is how authorization and the level is granted to the end_user.

Here's a screen shot of the Shell Profiles from the profile elements within cisco ACS.
( see  the blue and  wine colored arrows )

Key Points:

• The user can only be within ONE accprofile. The AccessProfile provide READ NONE or WRITE for the various commands section levels ( e.g firewall, system,etc.....)

• If a wildcard user is enable, this profile can override the define accprofile for the wildcard.

• If the accprofile reference does not exist, the "default accprofile for that user is granted"

A  FortiOS sample  accprofile configuration:

config sys accprofile
    edit "CORP_LEVEL2"
        set comments "TIER#2 ENGINEERS"
        set mntgrp read
        set admingrp read
        set updategrp read
        set authgrp read-write
        set sysgrp read
        set netgrp read
        set loggrp read
        set routegrp read
        set fwgrp custom
        set vpngrp read
        set utmgrp read
        set wanoptgrp read
        set endpoint-control-grp read
        set wifi read
            config fwgrp-permission
                set policy read-write
                set address read-write
                set service read-write
                set schedule read
                set packet-capture read
                set others read-write
            end
    next
    edit "CORP_ENG_SR"
        set comments "SENIOR SEC-ENG"
        set mntgrp read-write
        set admingrp read
        set updategrp read-write
        set authgrp read-write
        set sysgrp read-write
        set netgrp read-write
        set loggrp read-write
        set routegrp read-write
        set fwgrp read-write
        set vpngrp read-write
        set utmgrp read-write
        set wanoptgrp read-write
        set endpoint-control-grp read-write
        set wifi read-write
    next
end

The cli diag debug app fnbamd -1 command will provide details on authen/authorization.

and  the following command will show authentication  PASS/FAIL and any accprofile  that's applied

diag test authserver tacacs+ < TAC_USER_NAME_HERE>  <username> <password>


e.g testing socadmin1

Ken Felix
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

tacacs.net and fortigate

We've been testing the tacacs.net windows AAA server and I wanted to share the authorization profile that will allows you to pass  accprofile to the system admin  user if set accprofile-override has been enabled for the wildcard account.

Under tac_plus shruberry,  the configuration is similar.

shrubberry ( http://www.shrubbery.net/tac_plus/ )

Under tacaces.net you will deploy this in the authorization.xml group sections

tacacs.net    ( http://tacacs.net/documentation.asp )

Don't forget that fortiOS has a diagnostics debug command that will show you what's being passed.

e.g

Alternatively you can use the diag  debug app fnbamd -1 to see what & how the final tacacs reply-authorization status  for accept reply.

Both are great  diagnostic tools and methods for troubleshooting authserver  for both local or remote accounts.

Ken Felix
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

F5 tacacs accounting

To enable tacacs+ accounting on a LTM you need to make the changes from the tmsh. This our configured on  11.6.x


ken.felix@(BIGGIESMALLS)(cfg-sync Standalone)(Active)(/Common)(tmos)# list auth tacacs
auth tacacs system-auth {
    debug enabled
    protocol ip
    secret  T3jd83k3l31GE00f
    servers { 172.16.18.11  172.16.19.11}
    service ppp
}

and the following for  the logging accounting was set via the modify;

ken.felix@(BIGGIESMALLS)(cfg-sync Standalone)(Active)(/Common)(tmos)# list sys db config.audit*
sys db config.auditing {
    value "enable"
}
sys db config.auditing.forward.destination {
    value "10.52.1.10"
}
sys db config.auditing.forward.sharedsecret {
    value " T3jd83k3l31GE00f*"
}
sys db config.auditing.forward.type {
    value "tacacs+"
}
sys db config.auditing.truncate {
    value "disable"
}

e.g

modify sys db config.auditing.forward.sharedsecret value T3jd83k3l31GE00f

For tacacs+ roles ;

auth remote-role {

    role-info {

        F5operator {

            attribute F5-LTM-User-Info-1=operator

            console tmsh

            line-order 4

            role operator

            user-partition All

        }

        ResourceAdministrator {

            attribute F5-LTM-User-Info-1=resource

            console tmsh

            line-order 3

            role resourceadmin

            user-partition All

        }

        auditor {

            attribute F5-LTM-User-Info-1=auditor

            console tmsh

            line-order 1

            role auditor

            user-partition All

        }

        guest {

            attribute F5-LTM-User-Info-1=guest

            line-order 2

            role guest

            user-partition All

        }

    }

}

And for tac_plusd


group = F5admin {
     default service = permit
     pap = PAM
      service = ppp protocol = ip {
      F5-LTM-User-Console = 0
      }

}




group = F5resource {
 pap = PAM
 service = ppp protocol = ip {
 F5-LTM-User-Info-1 = resource
 F5-LTM-User-Console = 1
 F5-LTM-User-Role = 20
 }
}


group = F5operator  {
 pap = PAM
 service = ppp protocol = ip {
 F5-LTM-User-Info-1 = operator
 F5-LTM-User-Console = 1
 F5-LTM-User-Role = 400
 }
}


group = F5manager {
 pap = PAM
 service = ppp protocol = ip {
 F5-LTM-User-Info-1 = manager
 F5-LTM-User-Console = 1
 F5-LTM-User-Role = 100
 }
}



group = F5guest {
 pap = PAM
 service = ppp protocol = ip {
 F5-LTM-User-Info-1 = guest
 F5-LTM-User-Console = 1
 F5-LTM-User-Role = 700
 F5-LTM-User-Partition = all
 }
}

Ken Felix
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

Hotfix PaloAlto

Palo sent me a email a few days ago about a alert and I seen that they have a new name "h2" which I guess means hotfix .

I thought was very interesting. The advisory was pretty good in giving a quick update.

Ken Felix
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \