TAC_PLUS AAA 平台及web展示 - ToB企服应用市场:ToB评测及商务社交产业平台

# 下载并安装 TACACS+
### 不能使用apt来安装，Ubuntu 20.04 之后不再支持
### 可以在Ubuntu 18.04 或者同样版本的镜像上安装
apt-get update
apt-get install tacacs+
## 配置文件
vim tac_plus.conf
---------------------------------------------------
key = "tacacs123" #tacacs?key
accounting syslog;
accounting file = /var/log/tacacs_accounting.log #tail -f /var/log/tacacs_accounting.log
default authentication = file /etc/passwd
acl = network_admin {
# allow access from all sources
#permit = ^10\.
permit = ^115\.
permit = [0-9]{1,3}\.
# implicit deny (ie: anything else)
}
group = admin {
default service = permit
acl = network_admin
service = exec {
priv-lvl = 15
}
cmd = display {
permit .*
}
}
group = operator {
acl = network_admin
service = exec {
priv-lvl = 1
}
cmd = display {
permit .*
}
cmd = show {
permit .*
}
}
group = ro {
acl = network_admin
service = exec {
priv-lvl = 15
}
cmd = display {
permit .*
}
cmd = show {
permit .*
}
cmd = interface {
permit .*
}
cmd = undo {
permit shutdown
}
cmd = configure {
permit .*
}
cmd = no {
permit shutdown
}
cmd = exit {
permit .*
}
cmd = quit {
permit .*
}
cmd = screen-length {
permit .*
}
cmd = terminal {
permit .*
}
cmd = set {
permit cli.*
}
cmd = ping {
permit .*
}
cmd = tracert {
permit .*
}
cmd = admin {
permit show
}
cmd = shutdown {
permit .*
}
}
user = chen_admin { #chen_admin：账号
login = des aPzSgJMfBUGB2 #使用 tac_pwd，生成账号密码：7FLiiVJUDhin2
# expires = "Feb 20 2032"
member = admin #权限
}
user = chen_ro {
login = des temjCCsjBECmU
# expires = "Feb 20 2032"
member = ro #权限
}
####### 生成密码
tac_pwd
Password to be encrypted: admin@123
aPzSgJMfBUGB2
tac_pwd
Password to be encrypted: test123
temjCCsjBECmU
## 启动守护进程
/etc/init.d/tacacs_plus restart
* Restarting TACACS+ authentication daemon tacacs+ [ OK ]

复制代码

cat /etc/tacacs+/tac_plus.conf
# Created by Henry-Nicolas Tourneur(henry.nicolas@tourneur.be)
# See man(5) tac_plus.conf for more details
# Define where to log accounting data, this is the default.
### TACACS+ 账户的日志文件
accounting file = /var/log/tac_plus.acct
# This is the key that clients have to use to access Tacacs+
## TACACS+ 密钥
key = testing123
# Use /etc/passwd file to do authentication
#default authentication = file /etc/passwd
# You can use feature like per host key with different enable passwords
#host = 127.0.0.1 {
# key = test
# type = cisco
# enable = <des|cleartext> enablepass
# prompt = "Welcome XXX ISP Access Router \n\nUsername:"
#}
# We also can define local users and specify a file where data is stored.
# That file may be filled using tac_pwd
#user = test1 {
# name = "Test User"
# member = staff
# login = file /etc/tacacs/tacacs_passwords
#}
# We can also specify rules valid per group of users.
#group = group1 {
# cmd = conf {
# deny
# }
#}
# Another example : forbid configure command for some hosts
# for a define range of clients
#group = group1 {
# login = PAM
# service = ppp
# protocol = ip {
# addr = 10.10.0.0/24
# }
# cmd = conf {
# deny .*
# }
#}
user = DEFAULT {
login = PAM
service = ppp protocol = ip {}
}
# Much more features are availables, like ACL, more service compatibilities,
# commands authorization, scripting authorization.
# See the man page for those features.

复制代码

mkdir /opt/tacacs
cd /opt/tacacs
# 1、Dockerfile 文件
vim Dockerfile
# Use Base Ubuntu image
FROM ubuntu:18.04
# Author of this Dockerfile
MAINTAINER Andrew Roderos
# Update & upgrades
RUN apt-get update && apt-get upgrade -y
# Install tacacs+ and Google Authenticator
RUN apt-get install tacacs+ libpam-google-authenticator -y
# Clear local repo
RUN apt-get clean
# Create a user with home directory
RUN useradd -m -d /home/andrew -s /bin/bash andrew
# Add password to andrew account
RUN echo "andrew:test" | chpasswd
# Copy Google secret key from host's volume to tacacs+ container
COPY .google_authenticator /home/andrew
# Change file owner
RUN chown andrew:andrew /home/andrew/.google_authenticator
# Copy tac_plus configuration file from host to the container
COPY tac_plus.conf /etc/tacacs+/tac_plus.conf
# Add tac_plus PAM
RUN touch /etc/pam.d/tac_plus
RUN echo auth requisite pam_google_authenticator.so forward_pass >> /etc/pam.d/tac_plus
RUN echo auth required pam_unix.so use_first_pass >> /etc/pam.d/tac_plus
# Run tac_plus as foreground process and use /etc/tacacas+/tac_plus.conf as the config file
#CMD ["tac_plus", "-G", "-C", "/etc/tacacs+/tac_plus.conf"]
# Install nginx, php-fpm
COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
ENV TZ=Asia/Shanghai
#### 配置变量 DEBIAN_FRONTEND ，可以使以下安装不需要输入直接进行安装
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get -y install nginx php php-fpm net-tools supervisor curl php-mysql php-common php-gd php-cli
COPY nginx.conf /etc/nginx/nginx.conf
### webui是web页面的压缩包，需要环境：php、MySQL（默认是MySQL5.7）
ADD webui_v1.7b1.tar /usr/local/nginx
RUN mkdir /run/php ; chown www-data:www-data /run/php
# Install mysql
RUN apt-get update;apt-get install mysql-server -y
COPY tac_plus.sql /usr/local/nginx/tac_plus.sql
COPY start.sh /usr/local/nginx/start.sh
CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]

复制代码

# 安装
apt-get install libpam-google-authenticator -y
# 生成 Google Authenticator 密钥
google-authenticator
##### 以下是输出内容
Do you want authentication tokens to be time-based (y/n) y
Warning: pasting the following URL into your browser exposes the OTP secret to Google:
https://www.google.com/chart?chs=200x200&chld=M|0&cht=qr&chl=otpauth://totp/root@template%3Fsecret%3DB4BFA57AJCLCZT2SIQLVBWJWFY%26issuer%3Dtemplate
# 下面是一个二维码的图片
Your new secret key is: B4BFA57AJCLCZT2SIQLVBWJWFY
Enter code from app (-1 to skip): -1
Code confirmation skipped
Your emergency scratch codes are:
22392718
78251317
47207995
37394412
76581106
Do you want me to update your "/root/.google_authenticator" file? (y/n) y
Do you want to disallow multiple uses of the same authentication
token? This restricts you to one login about every 30s, but it increases
your chances to notice or even prevent man-in-the-middle attacks (y/n) y
By default, a new token is generated every 30 seconds by the mobile app.
In order to compensate for possible time-skew between the client and the server,
we allow an extra token before and after the current time. This allows for a
time skew of up to 30 seconds between authentication server and client. If you
experience problems with poor time synchronization, you can increase the window
from its default size of 3 permitted codes (one previous code, the current
code, the next code) to 17 permitted codes (the 8 previous codes, the current
code, and the 8 next codes). This will permit for a time skew of up to 4 minutes
between client and server.
Do you want to do so? (y/n) y
If the computer that you are logging into isn't hardened against brute-force
login attempts, you can enable rate-limiting for the authentication module.
By default, this limits attackers to no more than 3 login attempts every 30s.
Do you want to enable rate-limiting? (y/n) y
## 把生成的配置文件拿过来
mv /root/.google_authenticator .

复制代码

cat tac_plus.conf
key = "tacacs123" #tacacs?key
accounting syslog;
accounting file = /var/log/tacacs_accounting.log #tail -f /var/log/tacacs_accounting.log
default authentication = file /etc/passwd
acl = network_admin {
# allow access from all sources
#permit = ^10\.
permit = ^115\.
permit = [0-9]{1,3}\.
# implicit deny (ie: anything else)
}
group = admin {
default service = permit
acl = network_admin
service = exec {
priv-lvl = 15
}
cmd = display {
permit .*
}
}
group = operator {
acl = network_admin
service = exec {
priv-lvl = 1
}
cmd = display {
permit .*
}
cmd = show {
permit .*
}
}
group = ro {
acl = network_admin
service = exec {
priv-lvl = 15
}
cmd = display {
permit .*
}
cmd = show {
permit .*
}
cmd = interface {
permit .*
}
cmd = undo {
permit shutdown
}
cmd = configure {
permit .*
}
cmd = no {
permit shutdown
}
cmd = exit {
permit .*
}
cmd = quit {
permit .*
}
cmd = screen-length {
permit .*
}
cmd = terminal {
permit .*
}
cmd = set {
permit cli.*
}
cmd = ping {
permit .*
}
cmd = tracert {
permit .*
}
cmd = admin {
permit show
}
cmd = shutdown {
permit .*
}
}
user = chen_admin { #chen_admin：账号
login = des aPzSgJMfBUGB2 #使用 tac_pwd，生成账号密码：7FLiiVJUDhin2
# expires = "Feb 20 2032"
member = admin #权限
}
user = chen_ro {
login = des temjCCsjBECmU
# expires = "Feb 20 2032"
member = ro #权限
}

复制代码

cat > supervisord.conf << EOF
[supervisord]
nodaemon=true
[program:nginx]
command=nginx
autostart=true
autorestart=true
[program:php-fpm]
command=/usr/sbin/php-fpm7.2 --nodaemonize --fpm-config /etc/php/7.2/fpm/php-fpm.conf
autostart=true
autorestart=true
[program:tac_plus]
command=tac_plus -G -C /etc/tacacs+/tac_plus.conf
autostart=true
autorestart=true
[program:mysql]
command=service mysql start
autostart=true
autorestart=true
[program:mysql-import]
command=/bin/bash /usr/local/nginx/start.sh
autostart=true
autorestart=true
EOF
#### 在webui解压之后需要把其中的 tac_plus.sql 导入到数据库中
#### 执行的前提是：MySQL服务已经启动
cat start.sh
#!/bin/bash
echo "Waiting for MySQL to be ready..."
while ! mysqladmin ping -h localhost -u root --silent; do
sleep 1
done
echo "MySQL is ready, importing data..."
mysql -uroot < /usr/local/nginx/tac_plus.sql

复制代码

cat nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 768;
}
http {
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
ssl_prefer_server_ciphers on;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
gzip on;
server {
listen 81;
server_name localhost;
location / {
root /usr/local/nginx;
index index.php index.html index.htm;
}
location ~ \.php$ {
root /usr/local/nginx;
fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
include fastcgi_params;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
include /etc/nginx/conf.d/*.conf;
#include /etc/nginx/sites-enabled/*;
}

复制代码

docker build -t tacacs:v1 .
docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
tacacs v1 9d57b17b34a1 19 seconds ago 572MB

复制代码

docker run -td --name tacplus -p 30080:81 -v /opt/tacacs/tac_plus.conf:/etc/tacacs+/tac_plus.conf -v /opt/tacacs/nginx.conf:/etc/nginx/nginx.conf tacacs:v1

复制代码

# 基础镜像
FROM ubuntu:18.04
# 作者
MAINTAINER Alyssa
# 更新
RUN apt-get update && apt-get upgrade -y
# 安装 tacacs+ and Google Authenticator
RUN apt-get install tacacs+ libpam-google-authenticator -y
# 清除本地repo
RUN apt-get clean
# 创建一个user
RUN useradd -m -d /home/andrew -s /bin/bash andrew
# 修改密码
RUN echo "andrew:test" | chpasswd
# 把密钥文件复制到镜像的指定目录下
COPY .google_authenticator /home/andrew
# Change file owner
RUN chown andrew:andrew /home/andrew/.google_authenticator
# Copy tac_plus configuration file from host to the container
COPY tac_plus.conf /etc/tacacs+/tac_plus.conf
# Add tac_plus PAM
RUN touch /etc/pam.d/tac_plus
RUN echo auth requisite pam_google_authenticator.so forward_pass >> /etc/pam.d/tac_plus
RUN echo auth required pam_unix.so use_first_pass >> /etc/pam.d/tac_plus
#### 在Dockerfile中，想要实现启动多个服务，可以使用 Supervisor，直接使用apt安装即可
COPY supervisord.conf /etc/supervisor/conf.d/supervisord.conf
ENV TZ=Asia/Shanghai
#### 配置变量 DEBIAN_FRONTEND ，可以使以下安装不需要输入直接进行安装
ENV DEBIAN_FRONTEND=noninteractive
### 想要webui启动服务，需要安装nginx, php-fpm，MySQL
RUN apt-get -y install nginx php php-fpm net-tools supervisor curl php-mysql php-common php-gd php-cli
COPY nginx.conf /etc/nginx/nginx.conf
### webui是web页面的压缩包，需要环境：php、MySQL（默认是MySQL5.7）
ADD webui_v1.7b1.tar /usr/local/nginx
RUN mkdir /run/php ; chown www-data:www-data /run/php
# 安装 mysql 5.7
RUN apt-get update;apt-get install mysql-server -y
COPY tac_plus.sql /usr/local/nginx/tac_plus.sql
COPY start.sh /usr/local/nginx/start.sh
CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/conf.d/supervisord.conf"]

复制代码

[program:mysql-import]
command=/bin/bash /usr/local/nginx/start.sh
autostart=true
autorestart=true
### 这部分的功能是在MySQL启动之后，把webui的sql导入到MySQL中，所以在shell脚本中，监控到服务启动执行再执行

复制代码

include /etc/nginx/conf.d/*.conf;
#include /etc/nginx/sites-enabled/*;
# 在这里注意的是，需要注释下面这个 include，这个目录下定义了一个默认的server，端口是80，与我们安装的环境的Apache2冲突，导致报错。所以这里直接注销掉。

复制代码

# 1、安装必要的软件包
sudo apt install dirmngr ca-certificates software-properties-common apt-transport-https curl lsb-release -y
# 2、将 GPG 密钥和仓库导入到 Ubuntu 系统
curl -fsSL http://repo.mysql.com/RPM-GPG-KEY-mysql-2022 | sudo gpg --dearmor | sudo tee /usr/share/keyrings/mysql.gpg > /dev/null
# 3、导入 MySQL 8.0 仓库
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/mysql.gpg] http://repo.mysql.com/apt/ubuntu $(lsb_release -cs) mysql-8.0" | sudo tee -a /etc/apt/sources.list.d/mysql.list
# 4、（可选）如果您是开发人员或具有特定需求，可以选择导入 MySQL 源代码仓库
echo "deb-src [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/mysql.gpg] http://repo.mysql.com/apt/ubuntu $(lsb_release -cs) mysql-8.0" | sudo tee -a /etc/apt/sources.list.d/mysql.list
# 5、（可选）开发人员还可以使用以下命令导入 MySQL 工具仓库
echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/mysql.gpg] http://repo.mysql.com/apt/ubuntu $(lsb_release -cs) mysql-tools" | sudo tee -a /etc/apt/sources.list.d/mysql.list
echo "deb-src [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/mysql.gpg] http://repo.mysql.com/apt/ubuntu $(lsb_release -cs) mysql-tools" | sudo tee -a /etc/apt/sources.list.d/mysql.list
# 6、更新。如果提示需要导入key，可添加参数：--allow-insecure-repositories 认为仓库是安全的，不需要提供key凭证
sudo apt update
# 7、安装 MySQL 8.0
sudo apt install mysql-community-server
#### 其他的配置和正常的安装MySQL8就一样了

复制代码