Redhat 9 - fails tio compile

[Toni Cosentino]

ello Marc 

I'm having errors while compiling on Redhat 9.5

make[2]: *** [/root/Tacacs_plus/Makefile.inc:49: ldapmavis-mt.o] Error 1
make[2]: Leaving directory '/root/Tacacs_plus/build/linux-5.14.0-503.21.1.el9_5.x86_64-x86_64/mavis'
make[1]: *** [GNUmakefile:21: build] Error 2
make[1]: Leaving directory '/root/Tacacs_plus/mavis'
make: *** [GNUmakefile:31: dirs] Error 1

Could you give me a hint?

Best Regards

 

[Marc Huber]

Hi Toni,

that's really not enough context, even for guessing. Please show the lines preceding the "make" error.

Cheers,

Marc

e.com/d/msgid/event-driven-servers/2a0f5609-e109-4fb8-beb9-a99ada972227n%40googlegroups.com.

[Toni Cosentino]

Hello Marc 

 sorry attached the output with errors.

--
You received this message because you are subscribed to the Google Groups "Event-Driven Servers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to event-driven-ser...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/event-driven-servers/9430e585-3fb6-4faf-b55d-9c8ed62845a1%40googlemail.com.

[Marc Huber]

Hi Toni,

looks like the PCRE2 development package isn't available. "sudo dnf install pcre2-devel" likely fixes that.

Cheers,

Marc

To view this discussion visit https://groups.google.com/d/msgid/event-driven-servers/CAMZVB67V9CxESj3rtBxh2yQXG5CqJEjuNEKn0Zf2hnnQJ%2B-3zw%40mail.gmail.com.

[Toni Cosentino]

Hello Marc thank you!

 the hint was right, bye the way there is still some issue.

Even if the tac_plus seems tio work correctly:

[root@CDWTACACS event-driven-servers]# systemctl status tac_plus
● tac_plus.service - TACACS+ Server
     Loaded: loaded (/etc/systemd/system/tac_plus.service; enabled; preset: disabled)
     Active: active (running) since Fri 2025-06-06 17:29:32 CEST; 2s ago
   Main PID: 327475 (tac_plus)
      Tasks: 6 (limit: 48773)
     Memory: 56.2M
        CPU: 268ms
     CGroup: /system.slice/tac_plus.service
             ├─327475 "tac_plus: 0 connections, accepting up to 6000 more"
             ├─327476 "tac_plus: 0 connections"
             ├─327477 perl /usr/local/lib/mavis/mavis_tacplus_ldap.pl
             ├─327478 perl /usr/local/lib/mavis/mavis_tacplus_ldap.pl
             ├─327479 perl /usr/local/lib/mavis/mavis_tacplus_ldap.pl
             └─327480 perl /usr/local/lib/mavis/mavis_tacplus_ldap.pl

Jun 06 17:29:32 CDWTACACS systemd[1]: Started TACACS+ Server.
Jun 06 17:29:32 CDWTACACS tac_plus[327475]: startup (version abd35fcecb4c9a4edccaf6a0c3067ef2c699f999)
Jun 06 17:29:32 CDWTACACS tac_plus[327475]: epoll event notification mechanism is being used
Jun 06 17:29:32 CDWTACACS tac_plus[327475]: bind to [::]:49 succeeded
Jun 06 17:29:32 CDWTACACS tac_plus[327476]: epoll event notification mechanism is being used

we cannot authenticate correctly from switch.

Attached you will find tac_plus configuration file, on the server is called tac_plus.cfg and the systemd service file .

From the switch I receive the following message when i try to login with AD account:

 

Keyboard-interactive authentication prompts from server:
| CCCC   Failed login. Five consecutive fails will revoke

And tac_plus is not writing any log and i don't see any traffic towards the domain controllers.

Best Regards

[Marc Huber]

Hi Toni,

I'm sorry, I can't actively help you with that. tac_plus is still in the GIT, but it's no longer supported.

That being said, this looks more like a configuration issue on your switch than a tac_plus issue. I can give a couple of generic suggestions to resolve this issue:

• run a packet capture on the server to verify that your switch is actually sending any packets (and WireShark can actually decode your TACACS+ packets if you're giving it the right key)
• run tac_plus in debug mode (e.g.: tac_plus -d -1 -1 -f /path/to/tac_plus.cfg) for testing
• use mavistest to validate your backend configuration

tac_plus really is at a dead-end, and the general recommendation is to move to tac_plus-ng.

Cheers,

Marc

[Toni Cosentino]

Hello Marc,

thanks for the suggestions.

Ok with debug options i can see this error:

601740: 08:49:22.011 2/44a7427c: 192.168.9.10 ---<start packet>---
601740: 08:49:22.011 2/44a7427c: 192.168.9.10 key used: T4c4csCDWT
601740: 08:49:22.011 2/44a7427c: 192.168.9.10 version: 192, type: 1, seq no: 2, flags: unencrypted
601740: 08:49:22.011 2/44a7427c: 192.168.9.10 session id: 7c42a744, data length: 45
601740: 08:49:22.011 2/44a7427c: 192.168.9.10 packet body (len: 45): \a\000\000'\000\000Illegal packet (version=0xc0 type=0x01)
601740: 08:49:22.011 2/44a7427c: 192.168.9.10 0000 07 00 00 27 00 00 49 6c  6c 65 67 61 6c 20 70 61  ...'..Il legal pa
601740: 08:49:22.011 2/44a7427c: 192.168.9.10 0010 63 6b 65 74 20 28 76 65  72 73 69 6f 6e 3d 30 78  cket (ve rsion=0x
601740: 08:49:22.011 2/44a7427c: 192.168.9.10 0020 63 30 20 74 79 70 65 3d  30 78 30 31 29           c0 type= 0x01)
601740: 08:49:22.011 2/44a7427c: 192.168.9.10 AUTHEN, status=7 (AUTHEN/ERROR) flags=0x0
601740: 08:49:22.011 2/44a7427c: 192.168.9.10 msg_len=39, data_len=0
601740: 08:49:22.011 2/44a7427c: 192.168.9.10 msg (len: 39): Illegal packet (version=0xc0 type=0x01)
601740: 08:49:22.011 2/44a7427c: 192.168.9.10 data (len: 0):
601740: 08:49:22.011 2/44a7427c: 192.168.9.10 ---<end packet>---

The key used is the right one.

If i try with tacacs_client from the server itself it works:

 [root@CDWTACACS ~]# tacacs_client -d -t pap -k T4c4csCDWT -u cwac1019 -H localhost authenticate

/usr/local/bin/tacacs_client:75: DeprecationWarning: The 'warn' method is deprecated, use 'warning' instead
  log.warn("\033[93mTACACS+ --debug will log raw packet data INCLUDING PASSWORDS;"
WARNING:__main__:TACACS+ --debug will log raw packet data INCLUDING PASSWORDS;proceed at your own risk!
password for cwac1019:
DEBUG:tacacs_plus.client:TACACSAuthenticationStart
sent header <version: 193, type: 1, session_id: 3862916550, length: 52, seq_no: 1, flags: 0>
sent body <action: 1, authen_type: 2, authen_service: 1, data: b'7V*uDfb96ffI', data_len: 12, priv_lvl: 0, port: python_tty0, port_len: 11, rem_addr: python_device, rem_addr_len: 13, user: cwac1019, user_len: 8>
DEBUG:tacacs_plus.client:TACACSAuthenticationReply
recv header <version: 193, type: 1, session_id: 3862916550, length: 6, seq_no: 2, flags: 0>
recv body <data: b'', data_len: 0, flags: 0, server_msg: b'', server_msg_len: 0, status: PASS>

Here is the log from tac_plus:
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 ---<start packet>---
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 key used: T4c4csCDWT
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 version: 193, type: 1, seq no: 1, flags: unencrypted
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 session id: e63f6dc6, data length: 52
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 packet body [partially masked] (len: 52): \001\000\002\001\b\v\r\fcwac1019python_tty0python_device************
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 0000 01 00 02 01 08 0b 0d 0c  63 77 61 63 31 30 31 39  ........ cwac1019
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 0010 70 79 74 68 6f 6e 5f 74  74 79 30 70 79 74 68 6f  python_t ty0pytho
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 0020 6e 5f 64 65 76 69 63 65  2a 2a 2a 2a 2a 2a 2a 2a  n_device ********
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 0030 2a 2a 2a 2a                                       ****
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 AUTHEN/START, priv_lvl=0
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 action=login (1)
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 authen_type=pap (2)
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 service=login (1)
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 user_len=8 port_len=11 rem_addr_len=13
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 data_len=12
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 user (len: 8): cwac1019
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 port (len: 11): python_tty0
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 rem_addr (len: 13): python_device
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 ---<end packet>---
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 authen: hdr->seq_no: 1
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 looking for user cwac1019 realm default
604158: 09:15:26.699 0/c66d3fe6: 127.0.0.1 user lookup failed
604158: 09:15:26.722 0/00000000: - creating user cwac1019 in realm default
604158: file=cwac1019 line=1 sym=[{] buf='{'
604158: file=cwac1019 line=1 sym=[member] buf='member'
604158: file=cwac1019 line=1 sym=[=] buf='='
604158: file=cwac1019 line=1 sym=[<string>] buf='Admin'
604158: file=__internal__ line=1 sym=[acl] buf='acl'
604158: file=__internal__ line=1 sym=[=] buf='='
604158: file=__internal__ line=1 sym=[<string>] buf='__internal__realm_default'
604158: file=__internal__ line=1 sym=[{] buf='{'
604158: file=__internal__ line=1 sym=[realm] buf='realm'
604158: file=__internal__ line=1 sym=[=] buf='='
604158: file=__internal__ line=1 sym=[default] buf='default'
604158: file=__internal__ line=1 sym=[}] buf='}'
604158: file=__internal__ line=1 sym=[<end-of-file>] buf=''
604158: file=cwac1019 line=1 sym=[}] buf='}'
604158: file=cwac1019 line=1 sym=[<end-of-file>] buf=''
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 looking for user cwac1019 realm default
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cfg_get: checking user/group cwac1019, tag (NULL)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cwac1019@python_device: ACL __internal__realm_default: NAS matched (unrestricted)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cwac1019@python_device: ACL __internal__realm_default: NAC matched (unrestricted)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cwac1019@python_device: ACL __internal__realm_default: Port matched (unrestricted)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cwac1019@python_device: ACL __internal__realm_default line 1: Realm "default" <=> "default"
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cwac1019@python_device: ACL __internal__realm_default: Realm matched
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cwac1019@python_device: ACL __internal__realm_default: Timespec matched (unrestricted)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cwac1019@python_device: ACL __internal__realm_default: ACL matched (unrestricted)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cwac1019@python_device: ACL __internal__realm_default: match
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cfg_get: checking user/group Admin, tag (NULL)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 user lookup succeded
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cfg_get: checking user/group cwac1019, tag (NULL)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cwac1019@python_device: ACL __internal__realm_default: match (cached)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cfg_get: checking user/group Admin, tag (NULL)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cfg_get: checking user/group cwac1019, tag (NULL)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cwac1019@python_device: ACL __internal__realm_default: match (cached)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cfg_get: checking user/group Admin, tag (NULL)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cfg_get: checking user/group cwac1019, tag (NULL)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cwac1019@python_device: ACL __internal__realm_default: match (cached)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 cfg_get: checking user/group Admin, tag (NULL)
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 pap login for 'cwac1019' from python_device on python_tty0 succeeded
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 Writing AUTHEN/PASS size=18
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 ---<start packet>---
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 key used: T4c4csCDWT
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 version: 193, type: 1, seq no: 2, flags: unencrypted
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 session id: e63f6dc6, data length: 6
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 packet body (len: 6): \001\000\000\000\000\000
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 0000 01 00 00 00 00 00                                 ......
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 AUTHEN, status=1 (AUTHEN/PASS) flags=0x0
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 msg_len=0, data_len=0
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 msg (len: 0):
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 data (len: 0):
604158: 09:15:26.722 0/c66d3fe6: 127.0.0.1 ---<end packet>---

I know you said tac_plus isn't supported anymore but i wonder if you can help me once more? :D

Best Regads

--
You received this message because you are subscribed to the Google Groups "Event-Driven Servers" group.
To unsubscribe from this group and stop receiving emails from it, send an email to event-driven-ser...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/event-driven-servers/8c813613-80f9-402b-bcfb-2e4d141ccc82%40googlemail.com.

[Marc Huber]

Hi Toni,

there might be an issue with the previous packet the router sends, most
likely a length mismatch. You might be able to verify that using Wireshark.

Cheers,

Marc