Securing Rancid with do_auth

in ,

Rancid can be made much more secure by using do_auth. A quick example of the do_auth.ini file is as follows: [users]
rancid =
     rancid_access
[rancid_access]
host\_allow =
     10.0.0.1
device\_permit =
     .*
command_permit =
     show.*
     dir.*
     more.*
     write t.*

Now, rancid can only login from 10.0.0.1, and only type commands that match those regular expressions. Technically, you could limit the commands in tac_plus.conf without do_auth. Might take longer, but you could do it. However, you could not limit it to 10.0.0.1 without an after authorization script such as do_auth.

NOTE: This assumes you only authorize config/Level 15 commands. I never authorize level 1 commands or, heaven forbid, level 0 commands as these commands can not change anything on the router, nor allow you to see the configuration. Now, if YOU choose to do so, the above example will still probably work. A quick look at log.txt will tell you any additional commands you will need to add.