topic Re: cli access with email usernames in General Topics

cli access with email usernames

samisu — Mon, 10 Jan 2022 19:27:59 GMT

Has anyone been able to authenticate to the CLI using a username such as username@domain.com over SSH using TACACS+ as authentication. Authenticating using the WebUI works fine, but when you try to SSH using ssh username@domain.com@ipaddress it just sends you back to the username screen. ( user is a superadmin role)

Re: cli access with email usernames

aleksandar.astardzhiev — Tue, 11 Jan 2022 11:19:36 GMT

Hi @samisu,

- What do you mean by "back to username screen"? Do you mean password prompt"

- I was thinking that two "@" could confuse the ssh command and it is not able to identify which part is username and which hostname, but I just test it and it seems it shouldn't be a problem. However just for the test, try to connect with "ssh -l username@domain.com ipaddress"

- What firewall system logs are showing when you try to login with ssh? Does it show the whole username "username@domain.com"?

On other hand - do you really need for the user to enter domain when accessing firewall management? If your TACACS is expecting username in the form of "username@domain.com", you can create Authentication Profile that will append the domain to the user input

Re: cli access with email usernames

BPry — Tue, 11 Jan 2022 15:26:04 GMT

@samisu,

This should work just based off of a quick test that I did as long as they SSH client being utilized isn't escaping anything. When you look at the logs (System -> (subtype eq auth)) do you see the proper user being submitted?

Re: cli access with email usernames

samisu — Tue, 11 Jan 2022 16:47:20 GMT

@aleksandar.astardzhiev so I just test what you suggest with the ssh -l its the something. I can to screen prompting me to enter the password as soon as I enter the password the screen goes back to username@domain.com@ipaddress password: and if I enter the password again I get a connection closed by ip address port 22. I think think the problem here is how its setup on the TACACS side.

As for the need, there are multiple domains and we have admins on different domains.

Re: cli access with email usernames

samisu — Tue, 11 Jan 2022 16:49:56 GMT

there is no logs in the PAN device showing any successful authentication. The logs from the TACACS server show it authenticated successfully. This points me to what I was thinking before. There is some type of miss configuration on the TACACS side. Thank you!