Subject: [netmod] Tacacs and YANG

From: Balazs Lengyel <[email-masked]>
Date: Mon, 9 Jan 2017 13:16:55 +0100

Hello,

We already have a radius model part in ietf-system; but are there any 
plans to develop a TACACS+ model for YANG?

How widely is TACACS+ used for remote authorization/accounting ? As an 
outsider I would guess that remote authorization could really slow down 
processing e.g. a big CLI script.

regards Balazs

-- 
Balazs Lengyel                       Ericsson Hungary Ltd.
Senior Specialist
Mobile: +36-70-330-7909              email: [email-masked]

---

From: Mahesh Jethanandani <[email-masked]>
Date: Mon, 9 Jan 2017 12:18:08 -0800

> On Jan 9, 2017, at 4:16 AM, Balazs Lengyel <[email-masked]> wrote:
> 
> Hello,
> 
> We already have a radius model part in ietf-system; but are there any plans to develop a TACACS+ model for YANG?
> 
> How widely is TACACS+ used for remote authorization/accounting ? As an outsider I would guess that remote authorization could really slow down processing e.g. a big CLI script.

Of the customers that I am interacting with, both use TACACS+ for authorization and accounting. My take is that there would a requirement for NETCONF to be able to interact with the server.

One way to deal with authorization is for the server to download the authorization rules and do local authorization instead of sending all the requests to the server, which as you point out would otherwise slow authorization down. 

A related question is, if NACM is used to setup rules for authorization, and there is a remote AAA server configured, are the rules for the NETCONF server to store and manage or are they for the AAA server? If the latter, what is communication channel between them?

Thanks.

Mahesh Jethanandani
[email-masked]

---

From: "Einar Nilsen-Nygaard (einarnn)" <[email-masked]>
Date: Fri, 13 Jan 2017 02:14:28 +0000

> On 9 Jan 2017, at 20:18, Mahesh Jethanandani <[email-masked]> wrote:
> 
> 
>> How widely is TACACS+ used for remote authorization/accounting?

einarnn> Quite widely. It is more capable than RADIUS for this task, and most used where traceability and auditing are key requirements.

>> As an outsider I would guess that remote authorization could really slow down processing e.g. a big CLI script.

einarnn> Yes. When it was humans typing at routers and switches it was not such a big deal, but with the rise of screen scraping as a substitute for the now-more-common model based APIs, I have seen instances of customer bring both network devices and TACAS servers to their knees when command authorisation is enabled.

Cheers,

Einar

> _______________________________________________
> netmod mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netmod

---

From: Phil Shafer <[email-masked]>
Date: Wed, 18 Jan 2017 16:28:34 -0500

>processing e.g. a big CLI script.

We use have clients using it.  Our fix for performance is to pre-load
regex-based constraints (from both radix and tacacs+ servers) to allow
pre-authorization of commands.  This also works during intermittent
networkings issues, which is vital for networking gear (assuming one
can do the initial login/pre-load operations).

Thanks,
 Phil