#!/usr/local/sbin/tac_plus-ng
id = spawnd {
        listen = { port = 49 }
        spawn = {
                instances min = 1
                instances max = 10
        }
        background = yes
}

id = tac_plus-ng {

        log authzlog { destination = /var/log/tac_plus-ng/authz/%Y/%m/%d.log }
        log authclog { destination = /var/log/tac_plus-ng/authc/%Y/%m/%d.log }
        log acctlog  { destination = /var/log/tac_plus-ng/acct/%Y/%m/%d.log }
        accounting log = acctlog
        authentication log = authclog
        authorization log = authzlog

        mavis module = groups {
                groups filter = /^(admins)$/ # these are defined below
                memberof filter = /^CN=tacacs_/ # use this as a prefix
        }


        mavis module = external {
                setenv LDAP_SERVER_TYPE = "microsoft"
                setenv LDAP_HOSTS = "ldaps://x.x.x.x:636 ldaps://x.x.x.x:636"
                setenv LDAP_BASE = "dc=xxxx,dc=xxxxe,dc=xxx"
                setenv LDAP_USER = "xxxxx"
                setenv LDAP_PASSWD = "xxxxx"
                setenv TACACS_GROUP_PREFIX = "tacacs_"
                setenv UNLIMIT_AD_GROUP_MEMBERSHIP = 1
                exec = /usr/local/lib/mavis/mavis_tacplus_ldap.pl
        }

        login backend = mavis
        user backend = mavis
        pap backend = mavis

        host world {
                address = ::/0
                welcome banner = "TACACS LOGIN \n"
                welcome banner fallback = "Emergency accounts are currently enabled.\n"
                authentication fallback = yes
                enable 15 = clear xxxxx
                key = xxxxx
        }

        profile admins {
                script {
                        if (service == shell) {
                                if (cmd == "")
                                        set priv-lvl = 15
                                permit
                        }
                }
        }

        profile readonly {
                script {
                        if (service == shell) {
                                if (cmd == "") { set priv-lvl = 15 permit }
                                if (cmd =~ /^show /) permit
                                if (cmd =~ /^terminal /) permit
                                if (cmd =~ /^exit /) permit
                                deny
                        }
                }
        }


        group admins
        group readonly

        user backup {
               password login = clear xxxxxx
               member = admins
               fallback-only
        }

        user oxidized {
               password login = clear xxxxxx
               member = readonly
               password pap = login
        }

        ruleset {
                rule {
                        script {
                                if (memberof =~ /^CN=tacacs_admins,/) { profile = admins permit }
                                if (member == admins) { profile = admins permit }
                                if (member == readonly) { profile = readonly permit }
                        }
                }
        }
}