Technical Tip: FortiAnalyzer/FortiManager matching "incorrect" TACACS+ admin profile
Description
This article describes the behavior of FortiAnalyzer/FortiManager with multiple 'wildcard' TACACS+ admin objects and disabled authorization option in the TACAS+ server object.
Scope
FortiAnalyzer/FortiManager.
Solution
Two TACACS+ admin objects are configured:
- 'testing' with the profile 'Restricted_User'.
- 'lala' with profile 'SuperUser'.
- Both have 'set wildcard enable' (to match all users on the remote server).
- The authorization option is disabled in the selected TACACS+ server object ('fac').
The debug output below shows the wildcard match process when the user 'lala' logs in:
diagnose debug application auth 8
diagnose debug enable
: auth request: user=lala from=GUI(192.168.244.154)
: wildcard admin: testing
: start tacacs+: fac
: wildcard admin: lala
: connecting to server 0: 10.47.2.45 ip=10.47.2.45 port=49
fac: connected
fac: sent authen-start: type=pap
fac: got authen-reply: pass(1)
fac: authorization disabled, skip groups/profile/adoms
fac: success
: matched wildcard admin: testing
: auth result: success
As visible from the debug output, despite how the username 'lala' is matching the name of the admin object 'lala', the FortiAnalyzer is matching the admin 'testing'.
This is because both are wildcard admins with no authorization attributes and the OS is matching those in the configuration order.
The solution in this scenario is to disable the wildcard option (in the GUI, 'Match all users on remote server') of the admin object.
The same user 'lala' logs in again, but now the 'auth' debug looks different:
: auth request: user=lala from=GUI(192.168.244.154)
: found admin: lala
: start tacacs+: fac
fac: connecting to server 0: 10.47.2.45 ip=10.47.2.45 port=49
fac: connected
fac: sent authen-start: type=pap
fac: got authen-reply: pass(1)
fac: authorization disabled, skip groups/profile/adoms
fac: success
: auth result: success
Note: The non-wildcard remote admins have a backup password, which is used if the remote server is unavailable. After disabling the wildcard option, of a remote administrator, it is recommended to configure a strong backup password:
Related article:
Technical Tip - How to configure TACACS+ for Admin Authentication and Authorization