When using rancid you have to store the username and password in a text file. When you don’t want to give the user privilege level 15 you have to store the enable password as well. Tacacs with authorization is the best solution to restrict access for the rancid user. Since the rancid user doesn’t need to change any configuration on the network devices, you can restrict the commands it is allowed to run.
When using tac_plus (http://www.shrubbery.net/tac_plus/) you can use the following definition for the rancid user:
user = rancid {
# default service = permit
login = cleartext "XXX"
enable = cleartext "XXX"
name = "Rancid User"
service = exec {
priv-lvl = 15
}
cmd = show {
permit .*
}
cmd = write {
permit term
}
cmd = dir {
permit .*
}
cmd = admin {
permit .*
}
cmd = more {
permit .*
}
}
The rancid user is automatically in enable mode because the privilege level is set to 15 in tacacs. You have to configure rancid no to enter enable mode. This is configured (for cisco devices) in ~rancid/.cloginrc
Enter the following details:
add user * rancid
add password * XXX
add method * telnet
add autoenable * 1
Pingback: Tacacs authentication on Avocent ACS terminal server « Rogierm's Blog
Thanks for the information, very helpful in locking things down,
however, I found that more.* was also required, otherwise rancid
seemed to finish, but the logs showed errors in ‘show running-config’
and ‘write term’ since both of those get sent via ‘more’.