From: Alan T. DeKok <aland@freeradius.org>
Date: Tue, 17 Jan 2023 21:28:07 +0000 (-0500)
Subject: sample tacacs client and configuration
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d9afc3bd996be3acf07546a721146babbbc54f91;p=thirdparty%2Ffreeradius-server.git

sample tacacs client and configuration
---

diff --git a/src/modules/rlm_tacacs/tacclient b/src/modules/rlm_tacacs/tacclient
new file mode 100755
index 00000000000..bfdca679985
--- /dev/null
+++ b/src/modules/rlm_tacacs/tacclient
@@ -0,0 +1,114 @@
+#! /bin/sh
+#
+# tacclient	Run a TACACS+ client
+#
+# Version:	$Id$
+#
+
+usage() {
+cat <<EOF
+Usage: tacclient [options] server[:port] <command> [secret]
+  <command>              One of auth-start, auth-continue, autz, acct
+  -4                     Use IPv4 address of server
+  -6                     Use IPv6 address of server.
+  -d <raddb>             Set user dictionary directory.
+  -D <dictdir>           Set main dictionary directory.
+  -f <file>              Read packets from file, not stdin.
+  -h                     Print usage help information.
+  -x                     Debugging mode.
+EOF
+exit 1
+}
+
+OPTIONS=
+
+TACCLIENT_PORT=4900
+
+# Quick pass to check options
+if [ $# -lt 2 ]
+then
+	usage
+fi
+
+TACCLIENT_CAST=
+OPT_d="-d ./raddb"
+OPT_D="-D share/dictionary"
+
+# Parse new command-line options
+while [ `echo "$1" | cut -c 1` = "-" ]
+do
+   case "$1" in
+	-4) 
+	    	TACCLIENT_CAST="<ipv4addr>"
+		shift
+		;;
+	-6) 
+	    	TACCLIENT_CAST="<ipv6addr>"
+		shift
+		;;
+	-d) 
+		OPT_d="-d $2"
+		shift;shift
+		;;
+	-D) 
+		OPT_D="-D $2"
+		shift;shift
+		;;
+	-f) 
+		OPTIONS="$OPTIONS -i $2"
+		shift;shift
+		;;
+	-x)
+		OPTIONS="$OPTIONS -x"
+		shift
+		;;
+
+	*)
+		usage
+		;;
+  esac
+done
+
+# Check that there are enough options left over.
+if [ $# -lt 2 ]
+then
+	usage
+fi
+
+#
+#  Parse packet type
+#
+PACKET_TYPE=
+case "$2" in
+	acct) 
+		TACCLIENT_PACKET_TYPE="Accounting-Request"
+		;;
+	autz) 
+		TACCLIENT_PACKET_TYPE="Authorization-Request"
+		;;
+	auth-start) 
+		TACCLIENT_PACKET_TYPE="Authentication-Start"
+		;;
+	auth-continue) 
+		TACCLIENT_PACKET_TYPE="Authentication-Continue"
+		;;
+	*)
+		usage
+		;;
+esac
+
+#
+#  Parse server name AFTER packet type, which lets the above
+#  code set the default port, but also lets the caller override
+#  it with "server:port"
+#
+TACCLIENT_SERVER="$TACCLIENT_CAST$1"
+TACCLIENT_SECRET=$3
+
+#
+#  These environment variables are used to fill in the configuration
+#  options in radclient.conf
+#
+export TACCLIENT_SERVER TACCLIENT_PORT TACCLIENT_SECRET
+
+exec ./build/make/jlibtool --mode=execute ./build/bin/local/unit_test_module $OPT_d $OPT_D $OPTIONS -p tacacs -i tacacs -n tacclient -X $@
diff --git a/src/modules/rlm_tacacs/tacclient.conf b/src/modules/rlm_tacacs/tacclient.conf
new file mode 100644
index 00000000000..fccd1bb3af4
--- /dev/null
+++ b/src/modules/rlm_tacacs/tacclient.conf
@@ -0,0 +1,66 @@
+#  -*- text -*-
+#
+#
+#  $Id$
+
+#######################################################################
+#
+#  = FreeRADIUS Client configuration file - 4.0.0
+#
+modules {
+tacacs {
+	transport = tcp
+	type = Authentication-Start
+	type = Authentication-Continue
+	type = Authorization-Request
+	type = Accounting-Request
+
+	tcp {
+		ipaddr = $ENV{TACCLIENT_SERVER}
+		port = 4900
+#		port = $ENV{TACCLIENT_PORT}
+		secret = $ENV{TACCLIENT_SECRET}
+	}
+
+	pool {
+		start = 1
+		min = 1
+		max = 1
+
+	}
+}
+}
+
+log {
+	colourise = yes
+}
+
+#
+#  Does nothing other than send packets.  It doesn't listen on any input sockets.
+#
+server default {
+	namespace = tacacs
+
+	listen {
+		type = Authentication-Start
+		type = Authentication-Continue
+		type = Authorization-Request
+		type = Accounting-Request
+	}
+
+	recv Authentication-Start {
+		tacacs
+	}
+
+	recv Authentication-Continue {
+		tacacs
+	}
+
+	recv Authorization-Request {
+		tacacs
+	}
+
+	recv Accounting-Request {
+		tacacs
+	}
+}