CiscoSecure UNIX Server User Guide
Release Notes 1.0(1)

Validating Data

In CiscoSecure 1.0, you can typically enter invalid data such as protocols, dates, or time values that do not exist. The data is stored in the AA database but cannot be processed. In CiscoSecure 1.0(1) you are prompted in many cases to enter data in a correct format so that it can be recognized by and acted upon by the CiscoSecure server and the network access server. In other cases, invalid data might still be accepted by the AA database. Be careful to enter only valid attributes when prompted by the GUI. [CSCdi47134]

Console Stalls After Sequence of GUI commands

In CiscoSecure UNIX Server 1.0, if you enter a sequence of GUI commands, you might find the GUI console to stall or hang indefinitely in some conditions. In CiscoSecure UNIX Server 1.0(1), the overall functionality of the GUI is more reliable than its predecessor. [CSCdi50540]

String Dialog Box

In CiscoSecure UNIX Server 1.0, when you click the User Attributes button and click the Cancel button in the resulting String dialog box, you might view a Tool Command Language (TCL) error message: In CiscoSecure 1.0(1), TCL error messages typically do not display in the GUI. [CSC56081]

Cancelling from Create User Still Stores Name

In CiscoSecure UNIX Server 1.0, if you click the Cancel button in the Create User dialog box, the specified username is still recorded by the CiscoSecure server database. Consequently, if you attempt to recreate that username, the CiscoSecure UNIX Server software might disallow the operation because of duplicate names. This problem is resolved in CiscoSecure UNIX Server 1.0(1). [CSCdi50395, CSCdi57312]

Error Message of Unable to Parse File

In CiscoSecure UNIX Server 1.0, when setting user attributes, if you specify "Prohibit service" in combination with a filter option, you see an error message "Unable to Parse File." In CiscoSecure 1.0(1), however, you can specify "Prohibit service" with any available filter option without generating an error message or causing the GUI to stall or become unresponsive. [CSCdi57913]

Misleading Message of "Protocol - Username too long"

In CiscoSecure UNIX Server 1.0, when the secret key for an access server does not match the one in the control file, the debugging output from the server incorrectly specifies "Protocol - Username too long." In CiscoSecure UNIX Server 1.0(1), the server now specifies, "Protocol - mismatched encryption." [CSCdi57951]

PPP Records Two Stop Packets

In CiscoSecure UNIX Server 1.0, when using CiscoSecure UNIX Server software with accounting functionality, and the router is using PPP, you might observe the accounting log to show two stop records for every session. One of the packets, recorded as stop, is actually a "watchdog" packet sent by the network access server during the beginning of the PPP negotiation. This watchdog packet is supposed to signify that the PPP negotiation has proceeded to the point where the IP address was assigned. However, CiscoSecure UNIX Server 1.0 does not recognize this watchdog, and instead writes the record as "stop." In CiscoSecure UNIX Server 1.0(1), this packet is now correctly identified in the accounting log as a watchdog rather than a stop packet. [CSCdi59124]

Extra Line Deleted When Setting User Attributes

In CiscoSecure UNIX Server 1.0, an extra line is sometimes inadvertently removed by software while you set a user's attributes. In particular, you might observe this behavior when you highlight a service in the console and attempt to press delete. In this case, the subsequent line of some other attribute also becomes highlighted and deleted. This problem has been resolved in CiscoSecure UNIX Server 1.0(1). [CSCdi59802, CSCdi59796]

Assigning an Invalid Time Qualifier

In CiscoSecure UNIX Server 1.0, if you enter a time that does not exist, such as 2500, the GUI might hang indefinitely. In CiscoSecure UNIX Server 1.0(1), you see a message that declares the specified time to be invalid and you are prompted to re-enter a value for the time. [CSCdi60542, CSCdi57395, CSCdi58817]

TCL Error Message After Clicking Right Mouse-Button on User Name

In CiscoSecure UNIX Server 1.0, you might receive a TCL error message when you click the right mouse button on a username. In CiscoSecure UNIX Server 1.0(1), TCL error messages typically no longer display in the GUI. [CSCdi61186]

Deleting Users and Groups Without Warning

In CiscoSecure UNIX Server 1.0, you could delete user or group entries, add groups, or change group names, without first being prompted for confirmation. In CiscoSecure UNIX Server 1.0(1), however, when making such permanent database changes, you are first presented with a dialog box in which you must confirm your choices. [CSCdi63364]

TCL Error Message After Specifying No Password

In CiscoSecure UNIX Server 1.0, you might receive a TCL error message when you click No Password in the User Attributes window. In CiscoSecure UNIX Server 1.0(1), TCL error messages typically no longer display in the GUI. [CSCdi62437]

Deleting a User

Although this feature is not documented in the user guide, you can delete a user by taking the following steps:

Step 1 Select the name of the group in which the user you want to delete resides.

Step 2 Select Open User List from the View menu.

Step 3 Select the name of the user you want to delete.

Step 4 Select Delete User from the Users menu.

[CSCdi50445]

Protocol Services

Support for IP, IPX, Link Control Protocol (LCP), ARAP, and EXEC have been added to the list of service attributes in the GUI.

Specifying the Date

CiscoSecure UNIX Server software enables you to specify a date on which authentication or authorization attributes become available or unavailable. The following is an example of the correct format:

21 Mar 96

This format is required by the CiscoSecure UNIX Server. Although the CiscoSecure UNIX Server GUI does not place any restrictions on the values you enter in the date field, if you enter the date incorrectly, the CiscoSecure UNIX Server will not recognize it.

Extended Encryption Keys

The length of the encryption key shared by the CiscoSecure server and network access server has been extended to 255 characters. In earlier versions of CiscoSecure UNIX Server software, the length of a valid key could not exceed 31 characters.

Editing User Attributes

In CiscoSecure UNIX Server 1.0, if you try to edit user attributes from the Users menu, the Users menu might remain highlighted, but the Edit User Attributes window does not display. The GUI stalls and becomes unresponsive to mouse clicks or keyboard strokes. In CiscoSecure UNIX Server 1.0(1), however, this problem has been resolved. [CSCdi57405]

Syslog Logging Levels

CiscoSecure uses the logging levels DEBUG, INFO, NOTICE, WARNING, ERROR, and ALERT. These logging levels are tied to the operation of CiscoSecure UNIX Server software, not to the interaction of the software to its users. However, much of the output that will help you resolve such problems can be found in the DEBUG level. To examine the output, enable DEBUG logging and turn on the relevant bits in the control file. [CSCdi61830]

Quoted String Dialog Box

In CiscoSecure UNIX Server 1.0, when pressing the Cancel button in some of the edit dialog boxes, you might see the error message "Not enough undo info available" and the GUI will pause indefinitely. This problem is resolved in CiscoSecure UNIX Server 1.0(1). [CSCdi57405, CSCdi57059]

Known Problems with the CiscoSecure UNIX Server GUI

This section identifies shortcomings of the CiscoSecure UNIX Server GUI that are expected to be addressed in a subsequent release.

Clicking Cancel Causes GUI to Stall

In CiscoSecure UNIX Server 1.0(1), you might experience the GUI to stall or hang after you click the Cancel button of many of the dialog boxes. If you encounter this problem, restart the GUI and try the operation again. [CSCdi63554]

Assigning the Same Name to a Group and User

In CiscoSecure UNIX Server 1.0(1), the GUI does not acknowledge the difference between a group and user with the same name. This will be fixed in a subsequent release of CiscoSecure UNIX Server software. [CSCdi70114]

Multiple Expiration Dates

In CiscoSecure UNIX Server 1.0(1), the GUI enables you to specify dates when security services become available or unavailable. If you inadvertently enter two or more expiration dates, the GUI will record them; however, the actual date on which the specified service will expire is unpredictable. Furthermore, if you save the database containing multiple-conflicting expiration dates, you might not be able to reload the database. To avoid uncertainty in when a particular service will expire, make sure that you enter only one expiration date. [CSCdi47149]

Unclear Error Messages with Clear Password

In some cases, you might see a TCL script error message similar to the following when establishing a clear password.

Error in Tcl Script
Error: can't read
"TacFMenu(NULL,function)":
no such element in array

In such cases, clicking on any other buttons in the GUI will yield other TCL script errors. To recover from this condition, you must cancel from the User Create window then edit the user attributes. This problem will be fixed in a subsequent version. [CSCdi56081, CSCdi62437, CSCdi50457]

Setting Passwords that do not Expire

In some cases, you might want to set a password so that it does not expire. Although not immediately apparent, you can set expiration data in the AA database so that different expiration periods can be assigned to each password at the user level.

Take the following steps to set a password declaration which does not carry a qualification time to expire:

Step 1 From the GUI, create a user whose password you do not want to expire.

You see the User Attributes window.

Step 2 Click the Password button.

Step 3 Click Clear to display the Quoted String dialog box.

Step 4 Enter a password such as Pass2, then click the OK button.

The GUI next displays buttons (From and Until) to specify time qualification.

Step 5 Rather than specify a time qualification, click the Finished button at the bottom of the column of user attribute buttons.

Requiring Users to Modify Their Passwords

In some cases you might want the ability to require that users modify their passwords upon initial login to CiscoSecure UNIX Server. This ensures that only the user knows his or her own password. You can set up an initial password when a new account is first created, then the first time the user authenticates, he or she must change the password.

user = joy {
    member = staff
    privilege = des "*" 2
    password = clear "My ClearText Password"
    service = ppp {
        default protocol = permit
        prohibit protocol = ipx
    }
    service = shell {
        default cmd = permit
        prohibit cmd = enable 
    } 
}

tacacs 49/tcp TACACS+

kill -SIGUSR1 `cat /etc/CiscoSecure.pid`

local0.debug    var/log/csuslog

  string = STRING | QSTRING
  password: FILESPEC string
  | SYSTEM
  | NO_PASSWORD
  | DES QSTRING
  | CLEAR QSTRING
  | ARAP QSTRING
  | PAP QSTRING
  | STRING
  | EXTERNAL STRING string
  | Shadow for Solaris

char    nas_name[]  /* NAS name */
char    user_name[]  /* username */
char    port_name[]  /* port the connection is on */
char    remote_address[]  /* where the user connected from */
char    record_type[]  /* (start, update, stop etc) */
char    server[]  /* hostname of the server, as an AV pair */
char    time[]  /* time of this record, as an AV pair */
char    date[]  /* date of this record, as an AV pair */
char    attribute_value_pairs[]  /* there are an arbitrary number of these */

0 AUTHEN_CLIENT_LOGIN_PROMPT    "\nUser Access Verification\n" 
1 AUTHEN_CLIENT_USERNAME_PROMPT       "Username: " 
2 AUTHEN_CLIENT_PASSWORD_PROMPT       "Password: " 
3 AUTHEN_CLIENT_SIGN_ON_MESSAGE       "" 
4 AUTHEN_CLIENT_CHANGEPASS_INTRO  "Change password sequence"
5 AUTHEN_CLIENT_PASSWORDS_IDENTICAL  "Error - passwords the same"
6 AUTHEN_CLIENT_PASSWORD_EXPIRED  "Your password has expired"
7 AUTHEN_CLIENT_TOO_MANY_TRIES_FOR_USERNAME  "Too many tries for username" 
8 AUTHEN_CLIENT_TOO_MANY_TRIES_FOR_PASSWORD  "Too many tries for password" 
9 AUTHEN_CLIENT_NEW_PASSWORD1   "New password: " 
10 AUTHEN_CLIENT_NEW_PASSWORD2   "New password again: " 
11 AUTHEN_CLIENT_PASSWORDS_DIFFERENT  "The passwords are different"
12 AUTHEN_CLIENT_BAD_PASSWORD   "Bad password" 
13 AUTHEN_CLIENT_CANT_CHANGE_PASSWORD  "You cannot change your password" 
14 AUTHEN_CLIENT_ACCOUNT_EXPIRY_WARNING  "Your account will expire in %d days"
15 AUTHEN_CLIENT_PASSWORD_EXPIRY_WARNING   "Your password will expire in %d days" 
16 AUTHEN_CLIENT_NEW_PASSWORD_CRITERIA "A password must be between six and thirteen 
characters, containing at least one alphabetic and numeric character."

18 AUTHEN_USER_NOT_FOUND        "Authentication - User not found" 
19 AUTHEN_BAD_METHOD_FOR_USER   "Authentication - Bad method for user" 
20 AUTHEN_BAD_TYPE              "Authentication - Bad type" 
21 AUTHEN_NO_USERNAME           "Authentication - No username specified" 
22 AUTHEN_INSUFFICIENT_PRIVILEGE  "Authentication - Insufficient privilege" 
23 AUTHEN_UNEXPECTED_DATA       "Authentication - Unexpected data" 
24 AUTHEN_UNEXPECTED_RESERVED_DATA  "Authentication - Unexpected reserved data" 
25 AUTHEN_INCORRECT_PASSWORD    "Authentication - Incorrect password" 
26 AUTHEN_ABORTED_SEQUENCE      "Authentication - Aborted sequence" 
27 AUTHEN_FILEHANDLING_ERROR    "Authentication - File handling error" 
28 AUTHEN_UNKNOWN_PASSWORD_TYPE  "Authen - Unknown password type" 
29 AUTHEN_USER_NOT_IN_FILE      "Authentication - User not in file" 
30 AUTHEN_ERROR_IN_EXTERNAL_FN,"Authentication - Error in external function"

31 AUTHEN_BAD_SERVICE           "Authentication - Bad Service" 
32 AUTHEN_BAD_ACTION            "Authentication - Bad Action" 
33 AUTHEN_SENDPASS_OK           "Authentication - SENDPASS (ok)" 
34 AUTHEN_SENDPASS_FAIL         "Authentication - SENDPASS (fail)" 

35 PROTOCOL_USERNAME_TOO_LONG   "Protocol - Username too long" 
36 PROTOCOL_NASNAME_TOO_LONG    "Protocol - NAS name too long" 
37 PROTOCOL_NASPORT_TOO_LONG    "Protocol - NAS port name too long" 
38 PROTOCOL_NACADDR_TOO_LONG    "Protocol - NAC address too long" 
39 PROTOCOL_BAD_PRIVILEGE       "Protocol - Invalid privilege field" 
40 PROTOCOL_ACTIVE_SESSION      "Protocol - Session id in use" 
41 PROTOCOL_NO_SESSION          "Protocol - No session found" 
42 PROTOCOL_INCORRECT_TYPE      "Protocol - Incorrect type" 
43 PROTOCOL_INCORRECT_SESSION   "Protocol - Incorrect session" 
44 PROTOCOL_INCORRECT_SEQUENCE  "Protocol - Incorrect sequence" 
45 PROTOCOL_INCORRECT_VERSION   "Protocol - Incorrect version" 
46 PROTOCOL_GARBLED             "Protocol - Garbled message" 
47 PROTOCOL_READ_TIMEOUT        "Protocol - Read timeout" 
48 PROTOCOL_CONNECTION_CLOSED   "Protocol - Connection closed" 
49 PROTOCOL_BAD_TYPE            "Protocol - Bad type" 
50 PROTOCOL_MAX_USERS_EXCEEDED  "Maximum number of users exceeded" 
51 PROTOCOL_ENCRYPTION_MISMATCH  "Mismatched encryption" 

52 AUTHOR_NO_SERVICE            "Authorization - No service specified" 
53 AUTHOR_FAILED_MANDATORY_ARG  "Authorization - Failed mandatory argument" 
54 AUTHOR_FAILED_COMMAND_LINE   "Authorization - Failed command line" 
55 AUTHOR_FAILED_SERVICE        "Authorization - Failed service" 
56 AUTHOR_FAILED_TIME           "Authorization - Failed time qualification" 
57 AUTHOR_BAD_ARGUMENT          "Authorization - Bad argument" 
58 AUTHOR_NO_COMMAND            "Authorization - No command specified" 
59 AUTHOR_FAILED_CMD            "Authorization - Failed command" 
60 AUTHOR_NO_PROTOCOL           "Authorization - No protocol" 
61 AUTHOR_UNKNOWN_USER          "Authorization - Unknown user" 
62 AUTHOR_INVALID_NAS_OR_PORT   "Authorization - Unauthorized NAS or PORT" 
63 AUTHOR_COMMAND_AUTHORIZED    "Authorization - Command authorized"