To Determine what should be the fallback for source address defined in services such as TACACS, NTP, SYSLOG , SNMP
If em0 is the source address for all the configured services such as TACACS, NTP, SYSLOG, & SNMP and if em0 goes down then local authentication fails if the local username and pd are not defined locally on the device.
If em0 is the source address for all the configured services such as TACACS, NTP, SYSLOG, & SNMP and if em0 goes down then local authentication fails if the tacacs/radius server is not reachable from the device itself
Below are two different test scenarios to determine when the local authentication will come into picture and when it will work and when it won't work.
Test Scenario 1:-
Configure default route towards em0 , configure source address for tacacs as em0 , configure authentication order to have only tacacs , also make sure the tacacs route is learned via other physical interface and bring down em0 and try local login.
Analysis:- We are able to login using local authentication when em0 is down and tacacs route is learned via other physical interface as well.
In order for the local authentication to work , device needs to have a local password configured for a user defined to access the device using local authentication.
LOGS:-
Local authentication worked when tacplus connect timed out:-
May 3 17:40:48 c19-25 sshd: PAM_TACPLUS_SEND_AUTHEN_FAIL: Failed in sending authentication with error connect: timed out.
May 3 17:40:48 c19-25 sshd: PAM_UNIX_AUTH_SERV_PROB: Detected authentication server problem.
May 3 17:40:48 c19-25 sshd: PAM_UNIX_TRY_LOC_PASSWD_AUTH: will attempt local password authentication.
May 3 17:40:52 c19-25 sshd: PAM_UNIX_LOC_PASSWD_AUTH: local password authentication of user 'neteng', succeeded
May 3 17:40:52 c19-25 sshd[26041]: Accepted keyboard-interactive/pam for neteng from 26.0.6.49 port 59535 ssh2
May 3 17:40:54 c19-25 sshd[26044]: Received disconnect from 26.0.6.49 port 59535:11: disconnected by user
May 3 17:40:54 c19-25 sshd[26044]: Disconnected from user neteng 26.0.6.49 port 59535
Local authentication worked when there was no route to host (tacacs server) from the device.
May 3 18:00:25 c19-25 sshd: PAM_TACPLUS_SEND_AUTHEN_FAIL: Failed in sending authentication with error connect: No route to host.
May 3 18:00:25 c19-25 sshd: PAM_UNIX_AUTH_SERV_PROB: Detected authentication server problem.
May 3 18:00:25 c19-25 sshd: PAM_UNIX_TRY_LOC_PASSWD_AUTH: will attempt local password authentication.
May 3 18:00:31 c19-25 sshd: PAM_UNIX_LOC_PASSWD_AUTH: local password authentication of user 'neteng', succeeded
May 3 18:00:31 c19-25 sshd[26136]: Accepted keyboard-interactive/pam for neteng from 26.0.6.49 port 58799 ssh2
==========================================================================================================
Test Scenario 2:-
Configure default route towards em0 in mgmt_junos routing instance, configure source address for tacacs as em0 , configure authentication order to have only tacacs , bring down em0 and try local login.
Analysis:-
Since the tacacs is configured to have the source address as em0 and em0 is down then their is no route to host (tacacs server).
Please find the working of local authentication :-
The local authentication would work when two of one scenario is present:-
1. tacacs server do not respond to a request
2. tacacs server rejects the request
First Scenario:-
1. If the authentication order includes RADIUS or TACACS+ servers, but the servers do not respond to a request, Junos OS always defaults to trying local password authentication as a last resort.
As per the test scenario, the em0 is down and tacacs is configured to have source address as em0 , the device will not send the request to the tacacs server, so that is why the local password authentication will not work as tacacs server
is neither receiving the request, nor it is sending the reject or no response for the request.
In this test case, Second Scenario does not come into picture , as tacacs server is not reachable from the device itself.
2. If the authentication order includes RADIUS or TACACS+ servers, but the servers reject the request, the handling of the request is more complicated.
If password (local password authentication) is included at the end of the authentication order and the remote authentication servers reject the authentication request, the device attempts local password authentication.
If password (local password authentication) is not included in the authentication order and the remote authentication servers reject the authentication request, the request ends with the rejection.