CiscoSecure UNIX Server User Guide
Release Notes 1.0

Four Free Ports When Installing CiscoSecure UNIX Server Software

As a bonus, when you run CiscoSecure UNIX Server software, four additional ports beyond the number of ports your license agreement stipulates, are allowed. For example, if you purchased a license to use 16 ports, CiscoSecure UNIX Server software will indicate that you are licensed to use 20 ports.

Complete installation information and examples are included in the CiscoSecure UNIX Server User Guide. However, for your convenience, the following information is provided to help you install CiscoSecure UNIX Server software, and to start and stop the server using the files contained in the samples directory. For more information, see the chapter "Configuring CiscoSecure UNIX Server Software" in the CiscoSecure UNIX Server User Guide.

CiscoSecure UNIX Server software Version 1.0 includes the binary image, CiscoSecure. You can install this program anywhere within the file system. However, for best results, install the CiscoSecure binary image in the directory /usr/local/etc. In order to perform its function, CiscoSecure UNIX Server software must be run with superuser privileges.

Take the following steps to install CiscoSecure UNIX Server software:

Step 1 Become superuser.

Step 2 Select a directory into which to install the CiscoSecure software. Normally, this would be a system directory such as /usr/etc/ciscosecure or /usr/local/etc/ciscosecure. Create this directory if it does not already exist and make it your current directory. For example:

% su

Password:

# mkdir /usr/local/etc/ciscosecure

# cd /usr/local/etc/ciscosecure

Step 3 Extract the distribution into the selected directory. The installation disks contain a compressed tar file:

# bar xvZf /dev/rfd0

Step 4 Edit the /etc/services file to include a definition for the TACACS+ protocol port number, if this is not already present. The protocol port number definition is as follows:

tacacs 49/tcp TACACS+

Step 5 Enter the hostid command to obtain the host ID of the system host.

# hostid

55412315

Step 6 Fill out the "CiscoSecure Software Key Fax-Back Form," including the host ID of the primary and backup CiscoSecure server systems, and fax it to the number on the form. Your software key will be returned within two business days. (For details, refer to the section "Licensing" in the chapter "Using CiscoSecure UNIX Server Software" of the CiscoSecure UNIX Server User Guide.)

Step 7 Edit the control file in /usr/local/etc/ciscosecure. At the beginning of the file, locate "LIST config_license_key" and enter the software key that was returned to you when you completed Step 6.

Step 8 Add the binary image, CiscoSecure, to the /etc/rc.local startup file if it is to be restarted automatically on system reboot.

When installation is complete, the CiscoSecure UNIX Server software control file and Authentication and Authorization (AA) database must be properly configured before starting the server. (See the chapters "Configuring CiscoSecure UNIX Server Software," and "The AA Database" in the CiscoSecure UNIX Server User Guide.)

User Guide Corrections

This section addresses errors in the CiscoSecure UNIX Server User Guide.

One Installation Disk

CiscoSecure UNIX Server software is provided on one disk. The documentation incorrectly references two disks.

Accounting Record Format

In the chapter "CiscoSecure UNIX Server Accounting," in the "Accounting Database" section, the accounting record format is incorrect. The correct format of the accounting record is structured as follows:

char    nas_name[]      /* NAS name */
char    user_name[]     /* username */
char    port_name[]     /* port the connection is on */
char    remote_address[]        /* where the user connected from */
char    record_type[]   /* (start, update, stop etc) */
char    server[]        /* hostname of the server, as an AV pair */
char    time[]          /* time of this record, as an AV pair */
char    date[]          /* date of this record, as an AV pair */
char    attribute_value_pairs[] /* there are an arbitrary number of these */

Message Catalogs

The message catalog in the appendix "CiscoSecure UNIX Server File Formats and Syntax" is incorrect. The following list identifies the correct default message IDs, message names, and message strings used by CiscoSecure UNIX Server software:

0 AUTHEN_CLIENT_LOGIN_PROMPT    "\nUser Access Verification\n" 
1 AUTHEN_CLIENT_USERNAME_PROMPT       "Username: " 
2 AUTHEN_CLIENT_PASSWORD_PROMPT       "Password: " 
3 AUTHEN_CLIENT_SIGN_ON_MESSAGE       "" 
4 AUTHEN_CLIENT_CHANGEPASS_INTRO  "Change password sequence"
5 AUTHEN_CLIENT_PASSWORDS_IDENTICAL  "Error - passwords the same"
6 AUTHEN_CLIENT_PASSWORD_EXPIRED  "Your password has expired"
7 AUTHEN_CLIENT_TOO_MANY_TRIES_FOR_USERNAME  "Too many tries for username" 
8 AUTHEN_CLIENT_TOO_MANY_TRIES_FOR_PASSWORD  "Too many tries for password" 
9 AUTHEN_CLIENT_NEW_PASSWORD1   "New password: " 
10 AUTHEN_CLIENT_NEW_PASSWORD2   "New password again: " 
11 AUTHEN_CLIENT_PASSWORDS_DIFFERENT  "The passwords are different"
12 AUTHEN_CLIENT_BAD_PASSWORD   "Bad password" 
13 AUTHEN_CLIENT_CANT_CHANGE_PASSWORD  "You cannot change your password" 
14 AUTHEN_CLIENT_ACCOUNT_EXPIRY_WARNING  "Your account will expire in %d days"
15 AUTHEN_CLIENT_PASSWORD_EXPIRY_WARNING   "Your password will expire in %d days" 
16 AUTHEN_CLIENT_NEW_PASSWORD_CRITERIA "A password must be between six and thirteen 
characters, containing at least one alphabetic and numeric character."

18 AUTHEN_USER_NOT_FOUND        "Authentication - User not found" 
19 AUTHEN_BAD_METHOD_FOR_USER   "Authentication - Bad method for user" 
20 AUTHEN_BAD_TYPE              "Authentication - Bad type" 
21 AUTHEN_NO_USERNAME           "Authentication - No username specified" 
22 AUTHEN_INSUFFICIENT_PRIVILEGE  "Authentication - Insufficient privilege" 
23 AUTHEN_UNEXPECTED_DATA       "Authentication - Unexpected data" 
24 AUTHEN_UNEXPECTED_RESERVED_DATA  "Authentication - Unexpected reserved data" 
25 AUTHEN_INCORRECT_PASSWORD    "Authentication - Incorrect password" 
26 AUTHEN_ABORTED_SEQUENCE      "Authentication - Aborted sequence" 
27 AUTHEN_FILEHANDLING_ERROR    "Authentication - File handling error" 
28 AUTHEN_UNKNOWN_PASSWORD_TYPE  "Authen - Unknown password type" 
29 AUTHEN_USER_NOT_IN_FILE      "Authentication - User not in file" 
30 AUTHEN_ERROR_IN_EXTERNAL_FN,"Authentication - Error in external function"
31 AUTHEN_BAD_SERVICE           "Authentication - Bad Service" 
32 AUTHEN_BAD_ACTION            "Authentication - Bad Action" 
33 AUTHEN_SENDPASS_OK           "Authentication - SENDPASS (ok)" 
34 AUTHEN_SENDPASS_FAIL         "Authentication - SENDPASS (fail)" 

35 PROTOCOL_USERNAME_TOO_LONG   "Protocol - Username too long" 
36 PROTOCOL_NASNAME_TOO_LONG    "Protocol - NAS name too long" 
37 PROTOCOL_NASPORT_TOO_LONG    "Protocol - NAS port name too long" 
38 PROTOCOL_NACADDR_TOO_LONG    "Protocol - NAC address too long" 
39 PROTOCOL_BAD_PRIVILEGE       "Protocol - Invalid privilege field" 
40 PROTOCOL_ACTIVE_SESSION      "Protocol - Session id in use" 
41 PROTOCOL_NO_SESSION          "Protocol - No session found" 
42 PROTOCOL_INCORRECT_TYPE      "Protocol - Incorrect type" 
43 PROTOCOL_INCORRECT_SESSION   "Protocol - Incorrect session" 
44 PROTOCOL_INCORRECT_SEQUENCE  "Protocol - Incorrect sequence" 
45 PROTOCOL_INCORRECT_VERSION   "Protocol - Incorrect version" 
46 PROTOCOL_GARBLED             "Protocol - Garbled message" 
47 PROTOCOL_READ_TIMEOUT        "Protocol - Read timeout" 
48 PROTOCOL_CONNECTION_CLOSED   "Protocol - Connection closed" 
49 PROTOCOL_BAD_TYPE            "Protocol - Bad type" 
50 PROTOCOL_MAX_USERS_EXCEEDED  "Maximum number of users exceeded" 
51 PROTOCOL_ENCRYPTION_MISMATCH  "Mismatched encryption" 

52 AUTHOR_NO_SERVICE            "Authorization - No service specified" 
53 AUTHOR_FAILED_MANDATORY_ARG  "Authorization - Failed mandatory argument" 
54 AUTHOR_FAILED_COMMAND_LINE   "Authorization - Failed command line" 
55 AUTHOR_FAILED_SERVICE        "Authorization - Failed service" 

56 AUTHOR_FAILED_TIME           "Authorization - Failed time qualification" 
57 AUTHOR_BAD_ARGUMENT          "Authorization - Bad argument" 
58 AUTHOR_NO_COMMAND            "Authorization - No command specified" 
59 AUTHOR_FAILED_CMD            "Authorization - Failed command" 
60 AUTHOR_NO_PROTOCOL           "Authorization - No protocol" 
61 AUTHOR_UNKNOWN_USER          "Authorization - Unknown user" 
62 AUTHOR_INVALID_NAS_OR_PORT   "Authorization - Unauthorized NAS or PORT" 
63 AUTHOR_COMMAND_AUTHORIZED    "Authorization - Command authorized" 

Late-Breaking News on the GUI and CiscoSecure Server

This section contains information that became available after the CiscoSecure UNIX Server User Guide was printed.

Working With S/Key Authentication

The S/Key one-time password system, from Bellcore, provides secure authentication over networks that are subject to eavesdropping. S/Key distinguishes itself from other one-time or multi-use authentication systems by preventing the user's secret password from ever crossing the network during login.

A Scenario of Using S/Key

To help you better understand the benefits of using S/Key with CiscoSecure UNIX Server software, consider the following example of a hypothetical user, Sue, who authenticates to the CiscoSecure network access server by means of the S/Key system.

1. Upon the standard prompt for authentication, Sue identifies herself to the network access server by her login name.
   

User Access Verification
Username: sue
s/key 97 fr09072
Password:

1. The CiscoSecure server then issues a challenge including the sequence number of the one-time password expected and a "seed." The seed is a special value used by the S/Key algorithm as the starting point for the creation of an S/Key password. This seed will also allow Sue to securely use a single secret password.
   Based on the verification display, the CiscoSecure server instructed the network access server to display the sequence number, 97, and a seed, fr09072, which will be used by a separate program to initiate the encryption process leading to an S/Key password.
   Sue notes the sequence number and seed, then pauses from her interaction with the network access server in order to generate a password. She will generate the password by entering the sequence number and seed, along with her secret password, into an S/Key calculator program.
   

2. Sue enters 97 and fr09072 into her S/Key calculator program at the UNIX prompt, as shown in the example display. (On UNIX, the S/Key calculator program is called key.)
   

% key 97 fr09072
Enter secret password: secret password

1. The secret password triggers the creation of a second password, as follows:
   

CRAG BAKE MOLT JEAN JIBE OFT

Password: CRAG BAKE MOLT JEAN JIBE OFT

1. The next time Sue attempts network access, she will be prompted for the one-time password sequence number, 96.
   The sequence number is one less than what was used for the previous authentication. In the case of Sue, her last sequence number was 97, so the next required sequence number will be 96. When the sequence number reaches 0, Sue will not be able to log in without reinitializing the S/Key system.
   

Sue's account could also be configured so that she is required to use S/Key when she enables on the router. In this case, the AA database would be modified to display something like the following:

user = sue {
        password = skey
        privilege = skey 15
}

In this case, Sue would be required to give a different S/Key password every time she logs in and every time she enables at level 15.

Preparing to Install S/KEY

Take the following steps to prepare for S/Key installation and use:

Step 1 Modify your CiscoSecure UNIX Server AA database file to set up each S/Key user. For example, to set up a hypothetical user named Sue, you would modify the CiscoSecure server AA database file as follows:

user = sue {

password = skey

}

Step 2 Restart the CiscoSecure server by entering the UNIX command as follows:

kill -HUP `cat /etc/CiscoSecure.pid`

21 Mar 96