IOS-XR basic TACACS configuration

This is a basic, working AAA TACACS+ configuration. Local fallback AAA is the local user cisco.

Line console uses local authentication unconditionally in below example. No matter if the TACACS server is running or not, local authentication only. The TACACS server group is called auth-server. The server auth-server contains 2 TACACS servers, host 10.255.255.1 and host 10.255.255.2.

configure
!
tacacs-server host 10.255.255.1 port 49
 key 7 0055415509421F070C204F5D021C1C
 timeout 1
!
tacacs-server host 10.255.255.2 port 49
 key 7 135445410615102B28252B203E270A
 timeout 1
!
username cisco
 group root-lr
 group cisco-support
 secret 5 $1$xE2F$K9GxT/QI1eosQhXS6y/2D/
!
aaa group server tacacs+ auth-server
 server 10.255.255.1
 server 10.255.255.2
!
aaa authorization exec default none
aaa authentication login default group auth-server local
!

The XR AAA command: aaa authorization exec default none has the same effect as the IOS AAA command: aaa authorization exec default group auth-server if-authenticated. The configuration states that if a user is authenticated, that user is also authorized.

If the line console should use TACACS+ AAA first then fallback to local AAA, use following additional configuration:

configure
!
line console
 login authentication default
!
commit

Short verification saves countless hours. Stop the TACACS+ daemon on both auth-servers, in shown example 10.255.255.1, 10.255.255.2 and verify if fallback authentication really works. If it does, then you are good prepared for a central AAA outage.

Building 64bit alpine linux GNS3 FRRouting appliance

This is a 64bit version of the how to article Building an tiny GNS3 FRR linux appliance article. Many features in the linux IP stack and in the FRRouting implementation rely running on 64 bit architecture. Using the x86 architecture not all available protocols will work as they should, trouble is ahead. Recommendation using only the real 64 bit for the superior routing network appliance netlab experience. Really.

This FRRouting installation needs only 100 MB of disk space.

📘 Note
x86 architecture is deprecated from the linux IP networking perspective. Use a most current x86_64 iso file from the official alpine linux website.

Get installation medium

This is for lazy folks, might use a old version, adjust to most recent release. The output file is stored to the /tmp directory in the host system:

user % wget https://dl-cdn.alpinelinux.org/alpine/v3.15/releases/x86_64/alpine-virt-3.15.4-x86_64.iso -P /tmp/

Change to the GNS3 QEMU images directory:

user % cd ~/GNS3/images/QEMU/

Create FRR guest image

Create an empty disk image file for the virtual guest installation. Here qcow2 is used. The qcow file is only 1 GB large, and the installation will result in taking 100 MB of disk space:

user % qemu-img create -f qcow2 frr822.qcow2 1G

Boot installation medium

After the diskfile has been created, use QEMU to boot the downloaded iso file. Enable serial port redirection to a localhost TCP port 4321:

user % qemu-system-x86_64 -boot d -cdrom /tmp/alpine-virt-3.15.4-x86_64.iso -hda ~/GNS3/images/QEMU/frr822.qcow2 -enable-kvm -m 1G -serial telnet:localhost:4321,server,nowait

read more

Change user membership on Gentoo linux

I tend to forget this, since I do not deal with users accounts on daily basis. And I need that from time to time, so a notice to myself

Add user to group, Add larry to the wheel group:

root # gpasswd -a larry wheel

Remove user from a group. Remove larry from the wheel group:

root # gpasswd -d larry wheel

Who is larry? Check for youself.

Gentoo removes python2.7 for good

Great news. It has been long overdue and I secretly hoped it will happen this year. Now it is time to remove Python2.7 from gentoo: Heading from the official website

2020-09-28-python-2-7-cleanup
  Title                     Python 2.7 cleanup is progressing
  Author                    Michał Górny <mgorny@gentoo.org>
  Posted                    2020-09-28
  Revision                  1

Python 2.7 has reached its end-of-life by 2019-12-31, and many projects
have removed Python 2 support since.  During the last few months we have
been working hard to migrate Gentoo to Python 3, and we have finally
reached the point making it possible for the vast majority of our users
to run a system free of Python 2.7 packages (except for the interpreter
itself).
...

Yes it is called cleanup, but actually majority of gentoo-ers can remove python2_7 This is really great news indeed. Finally it is gone, and now even from my systems as well. 3 packages needed rebuild. GNS3 runs here only using python3. So python selection looks now like below:

user % eselect python list

Available Python interpreters, in order of preference: [1] python3.7 [2] python3.6 [3] python3.8 (fallback)