topic Re: Tacacs accounting support in General Topics

Tacacs accounting support

Fernando_Lourei — Thu, 02 Aug 2018 11:46:07 GMT

Hi,

I have several clusters spread across the globe and i am using Tacacs+ authentication. Does anyone know if checkpoint R77.30 or R80.10 supports accounting features like send to the tacacs server all the commands and configurations made by the serveral administrators?

Thank you

Re: Tacacs accounting support

PhoneBoy — Fri, 03 Aug 2018 00:18:30 GMT

I assume we're talking about Gaia OS commands.

Through TACACS+ Accounting? Not to my knowledge.

However, the commands entered are sent to syslog, which could be centrally collected.

Aug 2 17:14:55 2018 GW xpand[5368]: admin localhost t +volatile:clish:admin:15862 t
Aug 2 17:14:55 2018 GW clish[15862]: User admin logged in with ReadWrite permission
Aug 2 17:14:58 2018 GW clish[15862]: cmd by admin: Start executing : show interface ... (cmd md5: 47fdeb5c773b9dac74c9fe311686ca76)
Aug 2 17:14:58 2018 GW clish[15862]: cmd by admin: Processing : show interface eth0 (cmd md5: 47fdeb5c773b9dac74c9fe311686ca76)
Aug 2 17:15:00 2018 GW xpand[5368]: admin localhost t -volatile:clish:admin:15862
Aug 2 17:15:00 2018 GW clish[15862]: User admin logged out from CLI shell

Re: Tacacs accounting support

Fernando_Lourei — Fri, 03 Aug 2018 07:40:53 GMT

Indeed i did not find any information about the accouting on tacacs but i will parse and use the syslog. Thank you for the tip!

Re: Tacacs accounting support

PhoneBoy — Fri, 03 Aug 2018 15:43:14 GMT

You may see some noise with this method as several automated commands from admin will also show up.

For users who don't log in as admin, it will definitely be helpful to know what they did

Re: Tacacs accounting support

Mark_Gurevich — Tue, 12 Nov 2019 15:23:31 GMT

Hello,

Are there any plans to add accounting for TACACS+ ?

Re: Tacacs accounting support

Enyi_Ajoku — Thu, 30 Jul 2020 18:18:41 GMT

Any update on this. Thanks

Re: Tacacs accounting support

Scottc98 — Fri, 24 Mar 2023 17:10:43 GMT

I'd also like to bump this up. Is there any support today or plans in the works to support TACACS+ accounting? What about Radius accounting?

Re: Tacacs accounting support

PhoneBoy — Fri, 24 Mar 2023 20:49:52 GMT

As far as I know, sending things via RADIUS or TACACS accounting is not planned.
If this is a requirement, I recommend working with your local Check Point office on an RFE.