# logging to facility local3 so it can be send of remotely to splunk
logging = local3

accounting syslog

default authentication = PAM

## PAM user enable = nopassword

PAM user default group = "tac-readonly"

PAM user group match = "tac-[cint]*"
PAM user group match = "tac-scripts-[rmab]*"

# use first match or last match when recursing groups

recurse group value = last

# This is the key that clients have to use to access Tacacs+

key = BADFALFDAFDAFDA

acl = Xnet {

	# XXX level 15 allowed devices:
	permit = 10\.XX\.XX\.
	permit = 10\.XX\.XX\.
	permit = 10\.XX\.XX\.
	permit = ^10\.XX5\.
	permit = ^10\.XX.XX3\.
	deny   = .*
}

acl = Ynet {
	# Ynet level 15 allowed devices:
	permit = ^10\.XX\.
	permit = ^10\.XX\.
	permit = ^10\.XX\.
	permit = ^10\.XX.
	permit = ^10\.XX\.
	deny   = .*
}

# LDAP Groups

group = tac-hosting
{
	member = TIER1
}

group = tac-coreint-admin
{
	member = TIER3LVL15
}

group = tac-corevpn-admin
{
	member = TIER3
}

group = tac-Xnet-modify
{
	member = XNET-BACKBONE
}

group = tac-scripts-Ynet
{
	member = YNET-BACKBONE
}

group = tac-nmc-modify
{
	member = TIER3
}

group = tac-dialindus-modify
{
	member = TIER2
}

group = tac-readonly
{
	member = TIER0
}

# SCRIPT GROUPS

group = tac-scripts-readall
{
	member = TIER1
}

group = tac-scripts-modify
{
	member = TIER2
}

group = tac-scripts-all
{
	member = TIER3
}

# Internal groups


# Default deny stance, explicit permit
group = TIER0
{
        cmd = show
        {
	        permit ".*"
        }
        cmd = ping
        {
	        permit ".*"
        }
	member = DENYGROUP
}

# Default permit stance, explicit deny for TIER1..3

group = YNET-BACKBONE {

	acl = Ynet

	member = TIER3
}

group = XNET-BACKBONE {

	enableacl = Xnet

	member = TIER3
}

group = TIER1
{
        cmd = clear
        {
		permit "line"
        	deny ".*"
        }
        cmd = configure
        {
        	deny ".*"
        }
        cmd = reload
        {
        	deny ".*"
        }
	cmd = mirror-enable
	{
		deny ".*"
	}
	member = PERMITGROUP
}

group = TIER2
{
        cmd = mirror-enable
        {
                deny ".*"
        }
	member = PERMITGROUP
}

group = TIER3LVL15
{
	service = exec 
	{
		priv-lvl = 15
	}
	member = TIER3
}

group = TIER3
{
	member = PERMITGROUP
}

# Trailing group default permit stance
group = PERMITGROUP
{
	default service = permit

	member = TRAILERGROUP
}

# Trailing group default deny stance
group = DENYGROUP
{
	default service = deny

	member = TRALERGROUP
}

# Trailing group sets all defaults and recurse last overrides
group = TRAILERGROUP
{
        enable = PAM
}
