|
|
These release notes provide important updated information regarding CiscoSecure Access Control Server (ACS) 2.3(6) for UNIX. This document includes information about system requirements, Sun Solaris patch requirements, troubleshooting information, and known anomalies, including symptoms and work-around solutions.
This document contains the following sections:
The following information supplements the copyright information in the CiscoSecure ACS 2.3 for UNIX User Guide:
Copyright (C) 2000 by Jef Poskanzer. All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \Q\QAS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
This version of CiscoSecure ACS 2.3(6) for UNIX provides the following new features or enhancements:
For complete documentation for this product, please refer to the following documents:
This document can be viewed online at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/cs_unx/acsu235
This document, product number DOC-CSA2.3UX-IG, can be viewed online at the following URL:
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/cs_unx/acsu235/instl235.htm
The network components that interact with CiscoSecure ACS 2.3(6) for UNIX consist of:
 |
Note Cisco strongly recommends that CiscoSecure ACS be the only application running on this server. Combinations of different Cisco or non-Cisco applications have not been tested and are not supported. |
Each of these components has certain CiscoSecure configuration requirements.
CiscoSecure ACS (and its optional backup server) requires the following hardware and software:
Ultra 1 with a processor speed of 167 MHz or better
—Minimum 200 MHz if the Oracle or Sybase RDBMS is installed on the same system.
—Ultra 10 or better if the Oracle or Sybase RDBMS is installed on the same system
To check your version of Solaris, enter the Solaris command uname -a. If the system returns 5.5.1, Solaris 2.5.1 is installed. If the system returns 5.6, Solaris 2.6 is installed. If the system returns 5.7, Solaris 7 is installed. If the system returns 5.8, Solaris 8 is installed.
|
Note To support the RADIUS tunneling feature of CiscoSecure, the Sun Ultra 1or compatible workstation must be running Solaris 2.6, Solaris 7, or Solaris 8. |
CiscoSecure ACS works with the following network access servers (NASes):
|
Note To support the RADIUS tunneling feature of CiscoSecure, the AAA server must be running Cisco IOS Release 12.0(5)T or another vendor's NAS software that supports RADIUS tunneling attributes. |
The web-browser-based CiscoSecure ACS workstation console requires the following hardware and software:
|
Note The browser must be enabled for Java and Java Script. For a list of supported browsers, refer to http://www.cisco.com/warp/customer/480/13.html. |
· Netscape Communicator v4.51, v4.61, v4.7,4.72
· Netscape Communicator v4.51, v4.61, v4.7,4.72,4.74
· Microsoft Windows Internet Explorer v4.01 SP2, v5,v5.5
To support CiscoSecure database requirements, you can use either the supplied SQLAnywhere database engine or supported versions of your own pre-installed Oracle Enterprise or Sybase Enterprise software running on your network.
CiscoSecure has been tested with the following database engines:
Supported database engines include:
If your network requires these support features, Cisco recommends pre-installing the Oracle Enterprise or Sybase Enterprise database engine.
|
Note If you intend to set up CiscoSecure with Oracle database replication, Cisco recommends that you read the PDF document Using CiscoSecure with Oracle's Distributed Database Feature (filename csbsdoc.pdf) before you install the Oracle or CiscoSecure software. This document is located in the $BASEDIR/FastAdmin/docs directory of the CiscoSecure distribution CD-ROM. It provides an easy-to-understand, start-to-finish, screen-by-screen configuration example of setting up Oracle database replication to work with CiscoSecure. |
If you are supporting token servers, they must be installed on the network before you install CiscoSecure ACS. Supported token servers include:
You can use the Solaris showrev -p command to determine which Solaris patches are already installed on your system. Required patches or their latest versions can be downloaded from:
http://sunsolve.sun.com . README files for each patch are also available at this site.
|
Note You might require a SunSpectrum support contract to obtain some or all of the required patches. |
When using the Solaris 8 operating system, no patches are required.
When using the Solaris 7 operating system, no patches are required.
When using the Solaris 2.6 operating system, the installation script checks for the following patches:
and at least one of the following:
When using the Solaris 2.5.1 operating system, the installation script checks for the following patches
CiscoSecure ACS for UNIX should be installed on an UltraSPARC workstation and running as a primary server. CiscoSecure ACS for UNIX should be the only application running on this workstation. Combinations of other applications running in parallel with CiscoSecure ACS have not been tested and are not supported.
This section lists caveats known to exist in CiscoSecure ACS 2.3(6) for UNIX and caveats resolved with its release.
This section provides information about anomalies that have been fixed and known anomalies in CiscoSecure 2.3(6) ACS for UNIX.
Table 1 lists and describes the anomalies fixed in CiscoSecure ACS 2.3(6) for UNIX that were found in previous versions of CiscoSecure ACS 2.3(5.x) for UNIX.
| Bug | Description |
|---|---|
Maximum session value is incorrect with DSM; DSM states that a user's maximum sessions has been exceeded while the user is no longer connected and a stop record has been sent (and recorded in the csuslog). Symptoms: Users will be rejected even if the number of active sessions is less than the allowed in case of DSM. Conditions: This sort of behavior occurs only if the Solaris workstation has more than one interface. The accounting start packet should arrive from one interface and the DNS should have the machine's name configured for the other interface's IP. Which means that the session recorded will have one IP (that is in the DNS, as DSM uses DNS) and the stop packet will have the other. Hence the session count is not reduced. |
|
Token Caching Fails when ISDN MLPPP user need authentication. The token caching fails when an ISDN user tries to authenticate second channel using MLPPP via SGBP. Symptoms: When ISDN authenticates to CiscoSecure, the second ISDN channel fails intermittently. ISDN users cannot dial in, don't require full band width. Conditions: The failure occurs because the current implementation of Cisco Secure has a security feature that does not allow two different type of interface (generated from IOS-NAS) for token caching validation scheme. In the current implementation, the interface type "virtual-access" (which is sourced from IOS-NAS after completing the SGBGP-VPN-L2F call for the second channel) and the "serial" sourced from IOS-NAS, first channel) combination are not allowed in token caching validation scheme. |
|
Clear password is displayed in the View page. The clear password is displayed in the View page of the GUI, though ViewProfile hides it with asterisk. Symptoms: You are able to see Clear Password in cleartext (unencrypted) in the Advanced admin password entry edit box. Conditions: When entering the password for Password Clear, the password is seen as clear text in the edit box. |
|
NIS+ system password does not work for Altiga VPN users Altiga VPN users are failing authentication when using a 'system' password with NIS+. Dial-up connections (via AS5300) work fine using the same profile. Local profiles with a 'clear' password work fine for both VPN and dialup. Symptoms: Altiga users will rejected if password system is used for authentication Conditions: The user profile has password system configured and Radius authentication is used. The system uses NIS server for user passwords |
|
From and until date increment by one day when password is changed through a telnet connection. Symptoms: In Cisco Secure 2.3(4.2), when you change the password through telnet, From and Until date is incremented by one day. Conditions: Sample Profile before password change through telnet: The profile after password change through Telnet: Workaround: Use Update Profile to update the correct "from" and "until" dates for the password. |
|
CiscoSecure Unix radius password expiration works but there are no warnings on expiration and no opportunity to change the password. Symptoms: Radius users with expired password are not prompted to change password Conditions: The users should be using Cisco Radius Dictionary previous to 12.05. |
|
In CiscoSecure for Unix Version 2.3.5, Startup script displays message "DBServer Started" even if DBServer fails to start. Symptoms: "DBServer Started" message is printed even if the DBServer fails to start. Conditions: The start up script for CSU will print the message "DBServer Started", even if the database does not start. Workaround: Ensure that the database connectivity exists. Then stop and restart CiscoSecure processes. |
|
CSUnix does not like a profile that includes "cmd=set". In csuslog, the following warning is displayed and the user fails authentication: Jul 21 16:11:49 CiscoSecure: WARNING - errors detected in profile 'XXXX' in database Symptoms: With the 'set' command in the profile, CiscoSecure does not allow you to login to either a switch or a router. Conditions: This tends to occur when "cmd=show" is changed to "cmd=set" and the permit version is not changed to permit port speed. Workaround: A space character should be configured in the profile's set command for authentication as in the following example: |
|
After upgrading from CSU2.3.3 using TACACS+ where max-session worked fine to RADIUS, some have reported that max-session (high performance) seems to have broken. Many are reporting users unable to dial in after they have been disconnected and try to connect. Symptoms: Radius users gets rejected due to improper max-session count. Conditions: The problem appears when the NAS does not receive the ACK which the ACS sent for Accounting start and so retries. ACS takes this re-try as a separate request and increments the count by one. |
|
Adding VSA with ID 0 will cause Exception. Symptoms: When we add new Radius Vendor specific Attribute with ID 0 in the dictionary there is no problem. The VSA is created. After doing this, if we try to create a new user and associate this VSA to this user, a exception occurs. Conditions: Exception is thrown if a VSA has vendor ID as 0. |
|
If Timezone not set, DBServer fails to start. In CSU ACS 2.3.5, DBServer will not start if TIMEZONE is not set in the Solaris Machine. Symptoms: DBserver wont start. |
|
Advanced GUI has problems with some of the attributes entered in User or Group profiles. Attributes can be entered in correctly, but when you reselect on the User or Group profile, a dialogue box will appear indicating: "Error at line xx: <partial attribute>." In addition, that profile will no longer be accessible via the GUI. Symptoms: When you reselect on the User or Group profile, a dialogue box will appear indicating the following: Conditions: The Advanced Graphical User Interface (GUI) for Cisco Secure Unix sometimes has problems with some of the attributes entered in User or Group profiles. Attributes can be entered in correctly, but when you reselect on the User or Group profile, a dialogue box will appear indicating: Where line xx represents the profile line number where the error occurred. <partial attribute> is the attribute found on the line indicated, except the first few characters of the attribute are missing. In addition, that profile will no longer be accessible via the GUI. This problem is only with the Advanced GU, and does not affect the operation of the Cisco Secure server. The profile can still be viewed and modified via the Command Line Interface and the attributes are still passed to the NAS. Workaround: If you receive the above error message, use the Command Line Interface to add, delete, or modify that profile. No other profiles are affected |
|
Documentation does not state clearly that CSU ACS for UNIX should be the only program running on server. Symptoms: In the CSUnix Installation Guide for all versions, it should be stated that the hardware recommendations are based on Cisco's recommendation that CiscoSecure be the only application running on this server. Combinations of different Cisco or non-Cisco applications have not been tested and are hence not supported. |
|
Aa Java error occurs intermittently. Things seem to work fine for a while then they must restart the ACS services to regain control. Symptoms: the GUI works fine for a while and then reports Java errors/exceptions intermittently. ACS must be restarted to regain control. Conditions: The ulimit value is very low in the AcmeServer.sh file Workaround: increase the value of ulimit in the AcmeServer.sh to 256. |
|
Password Validation in GUI and telnet are inconsistent. Password checking should be implemented to ensure the above statements from CSU docs are valid. |
|
CiscoSecure pre-process and post-process attributes do not work. |
|
CiscoSecure Compatibility Matrix on: http://www.cisco.com/warp/customer/480/13.html should include IE 5.0 as being supported by CSU 2.3.5.1. |
|
Would like to configure account disable for maximum login attempts per user. |
|
Oracle 8.0.5 is no longer supported by Oracle. 8.1.7 is the recommended version that customer wants to use. Need CSUnix to be supported on Oracle 8.1.X Workaround: Oracle version supported by ciscosecure should be used. |
|
CiscoSecure Unix does not support Altiga VPN3000 attributes. |
|
Request for enhancement for CiscoSecure Unix support on Solaris 2.8 and all subsequent versions of Solaris. |
|
In CiscoSecure Unix, When you are trying to create or update a user profile through the GUI, dates below 10 give problem in From and Until columns Symptoms: 'Invalid Date format' error pops in the advanced GUI Conditions: When a date less than 10 as 'd mmm yyyy' is entered |
|
The clear password is displayed in the View page of the GUI, though ViewProfile hides it with asterisk. Symptoms: Clear Password is displayed as cleartext (unencrypted) in the FastAdmin page and the View Profile in Text Format dialog in Advanced Admin. Conditions: When viewing a user profile in Fast Admin, the Clear Password is displayed as clear text. In the Advanced Admin, when viewing the profile in text format, the Clear Password is displayed in clear text. |
|
The clear password is displayed in the View page of the GUI, though ViewProfile hides it with asterisk. Symptoms: Clear Password is displayed as cleartext (unencrypted) in the Advanced admin password entry edit box after Submit button is clicked. Conditions: When entering the password for Password Clear, the password is echoed as stars. But after the Submit button is clicked, it is seen as cleartext. |
|
Ciscosecure Unix will fail during Installation if environmental variable LIBPATH is not set. Symptoms: error received during installation "pkgadd: ERROR: post-install script did not complete successfully" |
|
In Ciscosecure Unix, DBClient terminates when enter key is pressed without username. Symptoms: DBClient doesn't ask for Username again if we press enter for username |
|
Ciscosecure Unix allows a user profile to have From Time greater than Until time, where as it should not be. |
|
Need option to login back when user logs off from advanced Admin Symptoms: Ciscosecure Unix does not allow a user to login back when user logs off from advanced Admin. |
|
stop accounting records for failure not stored in DB Symptoms: Ciscosecure Unix does not allow accounting logging for authentication failure to the database. Accounting record for authentication failure due to user error are not stored in the database. |
The following caveats discovered in CiscoSecure ACS 2.3(5.1) for UNIX are known to exist in this release of CiscoSecure ACS 2.3(6) for UNIX.
You can access the most current Cisco documentation on the World Wide Web at http://www.cisco.com, http://www-china.cisco.com, or http://www-europe.cisco.com.
Cisco documentation and additional literature are available in a CD-ROM package, which ships with your product. The Documentation CD-ROM is updated monthly. Therefore, it is probably more current than printed documentation. The CD-ROM package is available as a single unit or as an annual subscription.
Registered CCO users can order the Documentation CD-ROM and other Cisco Product documentation through our online Subscription Services at http://www.cisco.com/cgi-bin/subcat/kaojump.cgi.
Nonregistered CCO users can order documentation through a local account representative by calling Cisco's corporate headquarters (California, USA) at 408 526-7208 or, in North America, call 800 553-NETS (6387).
Cisco provides Cisco Connection Online (CCO) as a starting point for all technical assistance. Warranty or maintenance contract customers can use the Technical Assistance Center. All customers can submit technical feedback on Cisco documentation using the web, e-mail, a self-addressed stamped response card included in many printed docs, or by sending mail to Cisco.
Cisco continues to revolutionize how business is done on the Internet. Cisco Connection Online is the foundation of a suite of interactive, networked services that provides immediate, open access to Cisco information and resources at anytime, from anywhere in the world. This highly integrated Internet application is a powerful, easy-to-use tool for doing business with Cisco.
CCO's broad range of features and services helps customers and partners to streamline business processes and improve productivity. Through CCO, you will find information about Cisco and our networking solutions, services, and programs. In addition, you can resolve technical issues with online support services, download and test software packages, and order Cisco learning materials and merchandise. Valuable online skill assessment, training, and certification programs are also available.
Customers and partners can self-register on CCO to obtain additional personalized information and services. Registered users may order products, check on the status of an order and view benefits specific to their relationships with Cisco.
You can access CCO in the following ways:
You can e-mail questions about using CCO to cco-team@cisco.com.
The Cisco Technical Assistance Center (TAC) is available to warranty or maintenance contract customers who need technical assistance with a Cisco product that is under warranty or covered by a maintenance contract.
To display the TAC web site that includes links to technical support information and software upgrades and for requesting TAC support, use www.cisco.com/techsupport.
To contact by e-mail, use one of the following:
| Language | E-mail Address |
|---|---|
In North America, TAC can be reached at 800 553-2447 or 408 526-7209. For other telephone numbers and TAC e-mail addresses worldwide, consult the following web site: http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml.
If you are reading Cisco product documentation on the World Wide Web, you can submit technical comments electronically. Click Feedback in the toolbar and select Documentation. After you complete the form, click Submit to send it to Cisco.
You can e-mail your comments to bug-doc@cisco.com.
To submit your comments by mail, for your convenience many documents contain a response card behind the front cover. Otherwise, you can mail your comments to the following address:
Cisco Systems, Inc.
Document Resource Connection
170 West Tasman Drive
San Jose, CA 95134-9883
We appreciate and value your comments.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
AccessPath, AtmDirector, Browse with Me, CCIP, CCSI, CD-PAC, CiscoLink, the Cisco Powered Network logo, Cisco Systems Networking Academy, the Cisco Systems Networking Academy logo, Fast Step, Follow Me Browsing, FormShare, FrameShare, GigaStack, IGX, Internet Quotient, IP/VC, iQ Breakthrough, iQ Expertise, iQ FastTrack, the iQ Logo, iQ Net Readiness Scorecard, MGX, the Networkers logo, Packet, RateMUX, ScriptBuilder, ScriptShare, SlideCast, SMARTnet, TransPath, Unity, Voice LAN, Wavelength Router, and WebViewer are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, Discover All That's Possible, and Empowering the Internet Generation, are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Enterprise/Solver, EtherChannel, EtherSwitch, FastHub, FastSwitch, IOS, IP/TV, LightStream, MICA, Network Registrar, PIX, Post-Routing, Pre-Routing, Registrar, StrataView Plus, Stratm, SwitchProbe, TeleRouter, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries.
All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0108R)
Copyright © 2001 Cisco Systems, Inc.
All rights reserved.
Posted: Sun Jan 19 08:47:25 PST 2003
All contents are Copyright © 1992--2002 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.