---
name: "do_auth"
section: "8"
platform: "linux"
package: "tacacs+"
version: "4.0.4.27a-3"
release: "Debian 10 (Buster)"
platforms: ["linux"]
url: "https://new.carta.tech/do_auth"
---

# do\_auth(8)

Program allowing more granular control than tac\_plus.

## NAME

do\_auth - Program allowing more granular control than tac\_plus.

## SYNOPSIS

**do\_auth** -u user \[-i Ip Address\] \[-d Device address\] \[-f Config filename\] \[-l Log file\] \[-D Debug mode\]

## DESCRIPTION

do\_auth is a python program written to work as an authorization script for  tacacs to allow greater flexability in tacacs authentication.  It allows a user to be part of many predefined groups that can allow different access to different devices based on ip, user, and source address.

Groups are assigned to users in the \[users\] section.  A user must be assigned to one or more groups, one per line.  Groups are defined  in brackets, but can be any name.  Each group can have up to 6 options  as defined below.

 host\_deny  	 	Deny any user coming from this host.  Optional.\
  host\_allow		Allow users from this range. Mandatory with -i.\
  device\_deny	 	Deny any device with this IP.  Optional.\
  device\_permit	 	Allow this range. Mandatory if -d is specified.\
  command\_deny	 	Deny these commands.  Optional.\
  command\_permit	Allow these commands.  Mandatory.

The options are parsed in order till a match is found.  Obviously,  for login, the commands section is not parsed.  If a match is not found, or a deny is found, we move on to the next group.  At the end, we have an implicit deny if no groups match.  All tacacs keys passed on login to do\_auth are returned.  (except cmd\*)  It is  possible to modify them, but I haven't implemented this yet as I don't need it.  Future versions may have an av\_pair &  append\_av\_pair option.

## OPTIONS

- \-u

  Username.  Mandatory.  $user

- \-i

  Ip address of user.  Optional.  If not specified, all host\_ entries are ignored and can be omitted. $address

- \-d

  Device address.  Optional.  If not specified, all device\_ entries are ignored and can be omitted.  $name

- \-f

  Config Filename.  Default is do\_auth.ini.

- \-l

  Logfile. Default is log.txt.

- \-D

  Activate debug mode.

## EXAMPLES

**do\_auth** -i $address -u $user -d $name -l /var/log/do\_auth.log -f /etc/tacacs+/do\_auth.ini

## EXIT STATUS

do\_auth returns 0 to allow, 1 to deny authorization.

## AUTHOR

Henry-Nicolas Tourneur from the do\_auth file written by Dan Schmidt.

## SEE ALSO

[tac\_plus(8)](/tac_plus/8.md), [tac\_plus.conf(5)](/tac_plus.conf/5.md)