Tacacs+ Fortigate Accounting

[DS819src]

Hi Marc,

I've a Fortigate device, which should be accounted too. The mainly problem is the cmd field shows only (show, get) instead of show user tacacs+ or get system status. It's really weird, if I want to audit it. The point of interest for Fortigate seems to be the field reason, see attachment.

Is there some options to get the field reason on the accounting file?

Regarding to the documentation, it's possible to modify the log format, but it ends with an error.
Error /etc/tac_plus-ng/tac_plus-ng.cfg:24: Expected 'log', but got 'format'

Thank you and cheers,

Daniel.

[MarcJHuber]

Hi Daniel,

using ${args} in an accounting format string should work:

accounting format = "%Y-%m-%d %H:%M:%S ... \t${args}\n"

Also, please git pull, I've just recognized that I didn't initialize some logging variables (service, protocol) in accounting context.

Thanks,

Marc

[DS819src]

Hi Marc,

unfortunately I got this error messages, I did the git pull before and install the new version.

Below is the output from tac_plus-ng -P /etc/tac_plus-ng/tac_plus-ng.cfg

#!/usr/local/sbin/tac_plus-ng                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       
                                                                                                                                                                                                                                                                                              
id = spawnd {                                                                                                                                                                                                                                                                                 
        listen = {                                                                                                                                                                                                                                                                            
                port = 49                                                                                                                                                                                                                                                                     
        }                                                                                                                                                                                                                                                                                     
        spawn = {                                                                                                                                                                                                                                                                             
                instances min = 1                                                                                                                                                                                                                                                             
                instances max = 10                                                                                                                                                                                                                                                            
        }                                                                                                                                                                                                                                                                                     
        background = yes                                                                                                                                                                                                                                                                      
} 

id = tac_plus-ng {
        log accesslog { destination = /var/log/tac_plus-ng/access/%Y%m%d.log }
        log authzlog { destination = /var/log/tac_plus-ng/authz/%Y%m%d.log }
        log authclog { destination = /var/log/tac_plus-ng/authc/%Y%m%d.log }
        log acctlog  { destination = /var/log/tac_plus-ng/acct/%Y%m%d.log }
        access log = accesslog
        accounting log = acctlog
        accounting format 
/etc/tac_plus-ng/tac_plus-ng.cfg:23: Expected 'log', but got 'format'
3270814: /etc/tac_plus-ng/tac_plus-ng.cfg:23: Expected 'log', but got 'format'
3270814: Detected fatal configuration error. Exiting.

Version 81f704d initialized

Cheers,

Daniel.

[MarcJHuber]

Hi Daniel,

please add the format specs to the log definition, such as:.

log acctlog  { destination = ...
        accounting format = "%Y-%m-%d %H:%M:%S ..."
}

Cheers,

Marc

[DS819src]

Hi Marc,

thanks for your advice, it works.

2024-08-07 18:58:51 +0200       10.24.48.210    testadmin                        stop                    event=sys_acct stop_time=1723049930635398713 reason="Add firewall.address 2.2.2.2"
2024-08-07 18:59:30 +0200       10.24.48.210    testadmin                        stop                    event=sys_acct stop_time=1723049968945557922 reason="Edit firewall.address 2.2.2.2"

It would be nice, if it's possible to get only the reason="Add firewall.address 2.2.2.2" or reason="Edit firewall.address 2.2.2.2", instead of event= stop_time= too, but for the first iteration it's enough, because the manufacturer has to fix some tacacs+ implementation on the device.

Many thanks for your help, cheers,

Daniel.

[MarcJHuber]

Hi Daniel,

thanks, so I assume it's safe to close this issue.

Cheers,

Marc