Tacacs authentication on Fortigate D600 firewall
I am trying to get tacacs authentication to work for user ronald (to start with) on our Fortigate 600D firewall.
Tacacs server is a Centos 7 linux machine running tac_plus.
Firewall config:
config global config system admin edit "ronald" set remote-auth enable set accprofile "super_admin" set vdom "OOB" set remote-group "fwadmins" set password ENC SH2NlBggP0nKPW8lt6sfJaohuRG4BpAyUSjXp8jp6Fb/+RIZX5LtM5yMm2/S84= next edit "ronald" set remote-auth enable set accprofile "super_admin" set vdom "OOB" set remote-group "fwadmins" set password ENC SH2NlBggP0nKPW8lt6sfJaohuRG4BpAyUSjXp8jp6Fb/+RIZX5LtM5yMm2/S84= end
config vdom edit OOB config user tacacs+ edit "tacserver" set server "10.11.1.11" set key ENC rRpp8EzKAhzRCOb0OaiS+voJjnRaN7g86rhrkLG3H4t6EF6QOrMPDTmR1Sx9yEYen1ScT6xpMBIlfjggc9IYcz2VlS42rFxaPeIA4cuWuvSxm/ HMJN2cA6b1+ZfBRYI+w74d6+wtKiVIKFwHpFCfxBTwtsbigNBtkLw55zqd2dKLWmg3FjWD0UbrQ+0/E/Hg== set authorization enable set source-ip 10.10.1.1 next end
config vdom edit OOB config user group edit "fwadmins" set member "tacserver" config match edit 1 set server-name "tacserver" set group-name "tacacs-servers" next end next end
tac_plus.conf config on Centos machine:
key = "xxxxxxxxxx" accounting file = /var/log/tac.acct # authentication users not appearing elsewhere via # the file /etc/passwd default authentication = file /etc/passwd acl = default { permit = 10\.10\.1\. }
# Group that is allowed to do most configuration on all interfaces etc. group = admin { login = PAM service = exec { priv-lvl = 15 } service = fortigate { admin_prof = "super_admin" } acl = default }
user = ronald { login = PAM member = admin }
However authentication is not working, when trying to login on the firewall with user ronald the tac_plus logfile shows:
Feb 12 10:17:28 tacserver tac_plus[5327]: connect from 10.10.1.1 [10.10.1.1] Feb 12 10:17:28 tacserver kernel: tac_plus[5327]: segfault at 0 ip 00007fdeb37ea097 sp 00007ffc3d945ab8 error 4 in libc-2.17.so[7fdeb36b5000+1b8000]
Can you please help me troubleshoot and fix this? I am already working for months on this with no result.
Best regards,
Ronald
