Mavis connection parameter to LDAP. Timeout, retry, logs.

[Serge Larin]

Hello, colleagues!

Time to time we the tacacs respond when login to switch:

"Permission denied, please try again." - cisco switch answer.

This typically happens after a long period of a 'silence' - nobody try to login to devices last 30-60 minutes. (approximately).

We suppose this happened due to unsuccessful connection to LDAP server (openldap on Linux). - We'll check the ldap separately, but some questions:

1) is it possible to configure the other connection parameters to LDAP,  At least retry, as I found only " LDAP_CONNECT_TIMEOUT  " -  Default: 1 (second).

2) is it possible to understand Mavis tried to connect to both servers (of the list) or only one? (which one?)

3) is it possible to find/configure a more detailed log output from Mavis module?

journalctl -u tac_plus-ng  -r
.....
Jul 31 17:04:30 tacplus-ng01 tac_plus-ng[737832]: 31c/1c8e45d5: 10.10.10.246 shell login for 'USERNAME' from 10.1.1.1 on tty1 succeeded (profile=cis>
Jul 31 17:04:30 tacplus-ng01 tac_plus-ng[737832]: 31c/1c8e45d5: 10.10.10.246 10.10.10.246: Possibly no single-connection support. Context feature ma>
Jul 31 17:04:30 tacplus-ng01 tac_plus-ng[737832]: 31c/1c8e45d5: 10.10.10.246 result for user USERNAME is ACK [113 ms]
Jul 31 17:04:30 tacplus-ng01 tac_plus-ng[737832]: 31c/1c8e45d5: 10.10.10.246 looking for user USERNAME in MAVIS backend   ----  SUCCESS  ----
Jul 31 17:04:23 tacplus-ng01 tac_plus-ng[737832]: 31b/4be59ddf: 10.10.10.246 looking for user USERNAME in MAVIS backend ----  FAILURE  ----
Jul 31 17:03:46 tacplus-ng01 tac_plus-ng[737832]: 31a/35a9770e: 10.10.10.246 looking for user USERNAME in MAVIS backend    ----  FAILURE  ----
.....

config:

mavis module = external {
        setenv LDAP_SERVER_TYPE = "generic"

        # mehrere LDAP-Server
        setenv LDAP_HOSTS = "ldap1.my.company:636 ldap2.my.company:636"

Version - should be latest.
Jul 31 11:35:45 tacplus-ng02 tac_plus-ng[809051]: - Version 8cd9646b08093f0c10f2de1e5da1dc7c1a6b2fe2 initialized
Jul 31 11:35:45 tacplus-ng02 tac_plus-ng[809051]: epoll event notification mechanism is being used
Jul 31 11:35:45 tacplus-ng02 tac_plus-ng[809050]: bind to [::]:49 succeeded
Jul 31 11:35:45 tacplus-ng02 tac_plus-ng[809050]: startup (version 8cd9646b08093f0c10f2de1e5da1dc7c1a6b2fe2)

Best,

Sergei.

[Marc Huber]

Hi,

configuration options for the Perl (and Python) backend scripts are detailled at the top of the corresponding script (and ldapmavis-mt options will be shown with `ldapmavis-mt -h`).

You're using the Perl backend, so server selection depends on the Net::LDAP implementation. I think the LDAP servers configured will be tried in sequence. There are a couple of retry mechanisms in the script --  it's easily possible that these doesn't cover everthing that can go wrong.

Regarding logs: the Perl script already writes some errors to STDERR, and tac_plus-ng will send these to syslog; you can easily modify the script to output more details.

Cheers,

Marc

--
You received this message because you are subscribed to the Google Groups "Event-Driven Servers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to event-driven-ser...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/event-driven-servers/eb96a878-78ea-4c2e-9dfc-d326eac44753n%40googlegroups.com.