				eTACACS++ DAEMON (tacppd)
				Version: 0.0.4 (development)


While no name for this project.
I think to call it extended TACACS++ daemon (this is eTACACS++), but
in common way i start to call it as 'tacppd' - "tacacs plus plus daemon".


NOTES
=====
Most information about network devices valid only for Cisco equipment

All comments and issues, and bug reports please send directly to me:
rv@kht.ru (Roman Volkov)
(while no maillist available)


ABSTRACT
========
TACACS+ provides access control for routers, network access servers
and other networked computing devices via one or more centralized
servers.  TACACS+ provides separate authentication, authorization and
accounting services. The full describe of TACACS+ protocol you can find
at ftp://ftp-eng.cisco.com/pub/tacacs/tac-rfc.1.78.txt or
http://search.ietf.org/internet-drafts/draft-grant-tacacs-02.txt
or in /doc directory of this distribution.
TACACS+ is used mostly for Cisco devices (but I saw it support in 3Com
HiPer too, and read about it in Cabletron devices).
RADIUS - this is other similar protocol, which working throught UDP
and have way to use vendor specific attributes.


PRODUCT
=======
This is our attempt to create scalable tacacs+/radius AAA server with
clean internal structure and additional features.
The main goal - full database support + integration
with billing system + easy user manipulation.
Also we try to do mechanism for real-time control user sessions -
with the really true information in it (we have network with some
low trusted channels, and often we have lost accounting packets
from network devices).
This program is developing on C++ with POSIX threads API. And it can
be compiled for any *nix system with POSIX threads (I suppose).
Currently supported platforms only Linux(x86),FreeBSD(x86),Solaris(SPARC)
(I don't have access to other, but if you need in other, contact me).


FEATURES
========
1. SQL database support for store user information (together with
authorization information, like per-client IP addresses, etc)
2. multiply redudancy databases, can connect to several types
of databases if appropriate module available
3. open interface for create own database support modules
4. password field in database encrypted by MD5
5. internal IP address pooling system
6. personal tacacs+ key for each device + access control
7. reconfiguration and monitoring on-fly via telnet
8. per-users work time-plan
9. NAS control via SNMP
10. SNMP modules with open interface for easy new devices adding


IN TODO LIST
============
1. Universal modular billing system
2. peer-to-peer rouming
3. API for external programs for control users sessions and get
statistical information via this server
4. Monitoring and configuration via http
5. Integrated RADIUS support
This list open...


DIRECTORIES AND FILES
=====================
	/contrib		- contributed products
	/etc			- config dir
		tacpp.conf	- configuration file
	/db			- database modules
	/snmp			- snmp devices modules
	/include		- include files for database and snmp modules
	/run			- pid-file dir
	/log			- log-file dir
	/tmp			- temporary files directory
	/ext			- external programs dir
	/http			- http monitor files
	/resource	- resource modules dir
	START.sh		- daemon start script

	
INSTALL
=======
Read INSTALL file.

For first-time install copy file "START.sh.orig" to "START.sh" and edit
it for your directory (read comments in file).

For first-time install copy file "etc/tacpp.conf.orig" to "etc/tacpp.conf"
and review it (and read "etc/README").

Check if you have workable database libraries
(database modules require it). For it, check database module which you
will use by ldd:
ldd snmp/postgresql.so
ldd snmp/mysql.so
if you see library libpq.so/libmysqlclient.so inside - all right
in other case, check you /etc/ld.so.conf or LD_LIBRARY_PATH
for path to appropriate shared library (and your PostgreSQL/MySQL too)

REMEMBER! you MUST HAVE appropriate PostgreSQL and/or MySQL libraries


DATABASE SYSTEM
===============
Please, contact your database administrator for create
appropriate database and database user

Edit "etc/tacpp.conf" file for database, REMEMBER database key, if you
have lost it, no way to restore user passwords.

Befor use, you should create database tables. After start
for database tables creation you should use CLI (command line interface):
in "database" mode you should use command "create" for tables creation
(see later for CLI description).

Indexes should be created manually.

Now you can add users into database, but remember, that you
should encrypt passwords before insert.
While we don't complete internal user control system, you can
use contributed script in /contrib dir for crypt/decrypt passwords.
The sample usercontrol script will be contributed later.

for PostgreSQL (http://www.postgresql.org):
contact database administrator to create special user
with grants to create, update, insert, select and drop tables
and indexes
the next step - from database admin user run psql like this:
psql -U username database_name
and type password on request
try to select/create tables for check your rights

for Oracle (http://www.oracle.com):
change to oracle user (typically by command "su - oracle")
and run:
sqlplus username/password@your.oracle.service
and test it.
We recommend to contact your DB administrator before.

BE CAREFULL!!!
The Database table format now in developing and can be changed!!!


Before Start Steps
==================
1. check tacppd/START.sh file for right path to tacppd home
   (read throught it for several options)
2. edit tacppd/etc/tacpp.conf file (copy it from tacpp.conf.orig)
   read carefully throught it and throught etc/README file
   the default admin user have username: admin and password: admin_password
   please, change databse ip and username/password
   NOTE: remember database crypto key!!! You will have lost your
   clients database if you have lost database key!
3. check availability of database
   be sure, that your user created in database and firewalls
   configuration correct
4. start START.sh script
5. try to connect to control system by
telnet localhost 2222  (or any port you defined in configfile for telnet)
you should see username request
type admin
and type admin_password as password
(this is default setting in tacpp.conf.orig)
in CLI (command line interface) you can use ? for getting help.

WARNING! CLI have only small set of commands, and i have tested it only
from Linux telnet.


CONFIGURATION
=============
the configuration file documentation available in
etc/README
you can edit this file from editor, but be carefully:
edit this file BEFORE starting tacppd - if you will edit
it AFTER, than you can simple lost your changes if you will
do "write" command from CLI
There are several sections available in configuration.


CLI
===
command-line interface available throught telnet.
Currently this is very early development stage of CLI.
You can configure your server throught CLI, and changes will
be immediately available. The next issue - "write" command will
crypt cleartext passwords.
When you connect to server via telnet you see string:
"tacpp(your_hostname)#"
it means, that you now in CLI.
try write "?" and press <ENTER> for help
No edit keys available in this version, be carefull!
Next issue: I have tested telnet special codes only for Linux telnet.
From Windows's HyperTerm you can have problems.
Currently you can see and change configuration and check/drop users
on your access servers

Full command map now:
tacpp(hostname)#
?
config -----
				debug
				user
				server
				access
				addrpool
				nas
				database
				show
				exit
write
show -------
				users
				nas
clear ------
				user
				port
database ----
				create
				add
				del
				exit
exit

config - change server configuration
you should do "write" command to store your working configuration
to startup configuration file (etc/tacpp.conf)

show - show several information
currently you can see only currently working users table and
network devices under control

clear - clear anything
currently you can drop users/ports on network devices

database - database control mode


HTTP interface
==============
It has core support for HTTP, but it feature will be in future
development.
In default configuration the http server started on port 8888,
and use username/password "webmin/webmin" for access.
Try it by http://localhost:8888
check access rights in config before.


NetFlow collection
==================
see tacpp.conf.orig or use CLI for configure NetFlow collector.
The log file with NetFlow information looks like
nf20011116.log
and recreate every day

log file format differ in depends of NetFlow packet versions

format v1:

ip_addr         IP addr of router which sends NetFlow information
version         version of NetFlow packets
SysUptime       time in msecs since router booted
unix_secs       current time in seconds since 0000 UTC 1970
unix_nsecs      residual nanoseconds since 0000 UTC 1970
First           SysUptime at start of flow
Last            SysUptime of last packet of the flow
protocol        IP protocol, 6-TCP, 17-UDP, 1-ICMP
srcaddr         ip source addr
srcport         TCP/UDP source port number
dstaddr         ip destination addr
dstport         TCP/UDP destination port
nexthop         next hop router's IP addr
input           input interface index
output          output interface index
dPkts           packets sent in time between First and Last
dOctets         octets sent in time between First and Last

format v5:

ip_addr         IP addr of router which sends NetFlow information
version         version of NetFlow packets
SysUptime       time in msecs since router booted
unix_secs       current time in seconds since 0000 UTC 1970
unix_nsecs      residual nanoseconds since 0000 UTC 1970
flow_sequence   sequence number of total flows seen
engine_type     type of flow switching engine (RP,VIP,etc)
engine_id       slot number of flow switching engine
First           SysUptime at start of flow
Last            SysUptime of last packet of the flow
protocol        IP protocol, 6-TCP, 17-UDP, 1-ICMP
srcaddr         ip source addr
srcport         TCP/UDP source port number
dstaddr         ip destination addr
dstport         TCP/UDP destination port
nexthop         next hop router's IP addr
input           input interface index
output          output interface index
dPkts           packets sent in time between First and Last
dOctets         octets sent in time between First and Last
src_as          source peer/origin Autonomous System
dst_as          destination peer/origin Autonomous System
src_mask        source route's mask bits
dst_mask        destination route's mask bits
tos             IP Type-of-Service


NETWORK ACCESS SERVER CONFIGURATION
===================================
Currently tacppd is testing only with Cisco equipment.

you should setting up TACACS+ on NAS:
 aaa new-model
 aaa group server tacacs+ OUR_TACACS
  server your.server.ip.addr
 tacacs-server host your.server.ip.addr port server_port key tacacs_key

NOTE: port and key should be same as in tacppd configuration file
NOTE2: "aaa group server" command can not be available. Don't care.

-for authentication add:
 aaa authentication login DIALUP group OUR_TACACS

-for ppp authentication:
 aaa authentication ppp DIALUP if-needed group OUR_TACACS

-for ppp authorization:
 aaa authorization network DIALUP group OUR_TACACS

-for tty commands authorization:
 aaa authorization exec DIALUP group OUR_TACACS

-for per-command authorization:
 aaa authorization commands <privilege level 1-15>

-for accounting:
 aaa accounting suppress null-username
 aaa accounting update newinfo
 aaa accounting network DIALUP start-stop group OUR_TACACS

-you can also use accounting periodic updates for extra users list
checking:
 aaa accounting update periodic 1

-and configure this all on interfaces:
 ppp authentication chap pap DIALUP
 ppp authorization DIALUP
 ppp accounting DIALUP

-and on tty lines:
 authorization exec DIALUP
 accounting connection DIALUP
 login authentication DIALUP

Next thing - set up SNMP:
 access-list 2 permit host your_server_host
 snmp-server community your_community_string RW 2
BE CAREFULL - add only your tacppd host into SNMP access-list!

for more information read your devices vendor documentation


TESTING
=======
Some TACACS+ testing tools available with libtacplus library
ftp://ftp.kht.ru/pub/unix/tacppd/libtacplus
in samples directory (tacacs+ client, performance meter, etc)


DATA IN DATABASE
================
Datas in database system

NOTE: field types in real database can be changed
by database drivers, this is only types in tacppd
internal structures

NOTE2: database tables format in developing now and can be
changed

NOTE3: for your own database control system you can use
example in "contrib" directory for encode/decode passwords.



1. AUTHENTICATION
-----------------
check user access rights

description: Users table
tablename: tp_users
	username	char(32)		-- user login --
	authtype	char(5)			-- type of authentication --
	password	char(50)		-- crypted password or cryptocard key --
	open		bool			-- open (true/false)--
	avpid		char(32)		-- authorization group id --
	chkid		char(32)		-- access check group id --
	bilid		char(32)		-- billing group id --
	maxsess		int				-- maximum allowed sessions --
	enable		char(50)		-- crypted enable password for this user --
	challenge	char(50)		-- challenge for one time passwords (crypted) --

index:
CREATE UNIQUE INDEX tp_users_index ON tp_users (username);

authtype:
pwd		- use password
nopwd	- no password - always open
cc0		- cryptocard display 0 (hex with no phone)
cc1		- cryptocard display 1 (hex with phone)
cc2		- cryptocard display 2 (dec with no phone)
cc3		- cryptocard display 3 (dec with phone)

to create crypted passwords you can use perl module and script in
/contrib directory, or use internal CLI database management system

User PppRV with pwd test, author group ppp-1, access gr ppp-1
username | password | open | avpid | chkid | maxsess
---------+----------+------+-------+-------+---------
  PppRV  |   test   | true | ppp-1 | ppp-1 |   1
-----------------------------------------------------

User "admin" with password "test2", author group "admin",
access group "aaa-1" and maxxsess 3
username | password | open | avpid | chkid | maxsess
---------+----------+------+-------+-------+---------
  admin  |   test2  | true | admin | aaa-1 |   3
-----------------------------------------------------

description: information about user access table
tablename: tp_chkid
	chkid			char(32)			-- access group id --
	chkidname	char(50)			-- it is full name --

index:
CREATE UNIQUE INDEX tp_chkid_index ON tp_chkid (chkid);


description: user access rights table
tablename: tp_chk
	chkid		char(32)		-- user access group --
	phone		char(64)		-- regex permitted phone --
	nas		char(64)		-- regex NAS ip addr --
	port		char(64)		-- regex nas access port --
	time		char(64)		-- time area string (cron style) --

index:
CREATE INDEX tp_chk_index ON tp_chk (chkid);

table for access additional control by phone, NAS addr, NAS port
and access time

if time not set - it means any time
time format:
* * * * *
^ ^ ^ ^ ^
| | | | +- day of week (0 - 6)
| | | +--- month of year (1 - 12)
| | +----- day of month (1 - 31)
| +------- hour of day (0 - 24)
+--------- minute of hour (0 - 60)

examples:
* * * * 0,6 - access only on Sat and Sun
* 20-8 * * 0,6 - access only on Sat and Sun from 20 to 8
10-20,40-50 * * * 1-3,0,6 - more complex example


Access from phone 322322 from any nas and any port	
    phone     |  nas | port | time
--------------+------+------+------------
 d+322322\/d+ |  .*  |  .*  |
-----------------------------------------
    
Access from any phone from nas 192.168.1.5 to any port
phone |        nas       | port | time
------+------------------+------+-----------
  .*  | ^192.168.1.5$    |  .*  |
--------------------------------------------
    
Access from any phone, any nas and from Asy1
phone | nas |   port   | time
------+-----+----------+-----------
  .*  |  .* | ^Asy1$   |
-----------------------------------

Portnames: Asy1 - AsyX for async dial-up connection (not-ISDN)
for ISDN portnames start with Se (Se0:10, ...)
for example on my AS5300 i see (Asy1 - Asy240 and Se0:1-Se7:30,...)

Access from any phone from nas 192.168.2.10 from Async1 and from
any nas from Async3
phone |        nas     |  port  | time
------+----------------+--------+-----------
 .*   | ^192.168.2.10$ | ^Asy1$ |
 .*   |      .*        | ^Asy3$ |
--------------------------------------------

P.S. you should remember, that ports for PPP access can be named as
AsyX or as ttyX (if user use chap/pap, then AsyX, if it use
access from terminal or manual mode - ttyX)

if you wish create several usernames for several destination
phone numbers you can use target masks on phone.
for example, i have two modem pools - one on phone 320101, other on
8200, and i use next masks:	
for 8-200:  ^8d+\/421232\:d+
for 32-01-01: ^8d+\/4212320101$

you should know, that if you use analog access server like
cisco 2511 or so on, then phone will be "async/"

also you should know the phone, which your NAS get from E1,
you can see it on Cisco equipment with command:	
debug isdn q931


2. AUTHORIZATION
----------------
check user rights after success access for some protocols
and some resources

description: information about authorization table
tablename: tp_avpid
	avpid			char(32)			-- authorization group id --
	avpidname	char(50)			-- it is full name --

index:
CREATE UNIQUE INDEX tp_avpid_index ON tp_avpid (avpid);

description: authorization table with per-group AV-pairs information
tablename: tp_avp
	avpid		char(32)			-- authorization group name --
	service	char(10)			-- for service --
	protocol	char(10)			-- for protocol --
	avp		char(128)		-- AV-pair entry --

index:
CREATE INDEX tp_avp_index ON tp_avp (avpid);
		
AV-pairs - authorization attributes in Tacacs+
any av-pair consist from two fields: avp name field and
avp data field (service=ppp, protocol=ip, etc)

You can use follow av-pairs:

service=
slip, ppp, arap, shell, tty-daemon, connection,
system, firewall

protocol=
lcp, ip, ipx, atalk, vines, lat, xremote, tn3270,
telnet, rlogin, pad, vpdn, ftp, http, deccp, osicp,
unknown

cmd=
shell (exec) command. Must be if service=shell
can be cmd=NULL

cmd-arg=
argument to shell (exec) command
can be multiple

acl=
number connection access-list (service=shell cmd=NULL)

inacl=
identifier for interface in access-list

outacl=
identifier for interface out access-list

zonelist=
numeric zonelist value (AppleTalk only)

addr=
network address

addr-pool=
identifier of address-pool

routing=
boolean (is routing information on interface)
permit/deny send routing updates throught this interface

route=
route for this interface
<dst_addr> <mask> [<routing_addr>]

timeout=
timer for connection (minutes), 0 - no timeout

idletime=
idle-timeout for connection (minutes)

autocmd=
auto-command to run (service=shell cmd=NULL)

noescape=
boolean (service=shell cmd=NULL)

nohangup=
boolean (service=shell cmd=NULL)

priv_lvl=
privilege level

remote_user=
remoute userid (TAC_PLUS_AUTHEN_METH_RCMD)

remote_host=
remote host (TAC_PLUS_AUTHEN_METH_RCMD)

callback-dialstring=
NULL or dialstring, NULL - for request from user

callback-line=
line for callback

callback-rotary=
rotary

nocallback-verify=
do not require authentication after callback

SOME EXTERNAL AVPAIRS (NOT IN RFC, BUT WITH CISCO SUPPORT)
- very-very useful....
inacl#<n> setup multiline access-list (<n>-row number)
inacl#1=permit ip any any
inacl#2=deny igrp ...
    
outacl#<n>
    
route#<n>   multiline route entries
    
rte-ftr-in#<n>  input access list definition for routing updates
                on interface
rte-ftr-in#0=router igrp 60
rte-ftr-in#1=permit 0.0.3.4 255.255.0.0
rte-ftr-in#2=deny any	
	
rte-ftr-out#<n>  output acl for routing update
    
sap#<n>  static saps
    
route#<n>  route table
    
sap-fltr-in#<n>  input sap filter list
sap-fltr-out#<n> output sap filter list
    
pool-def#<n>   address pool definition
pool-def#1=DIALUP 10.1.1.1 10.1.1.100
pool-def#2=INTERNAL 192.168.0.1 192.168.0.100

as i understand RFC, you can easy add your own av-pairs
if client understand it (be careful, sometimes it can be
wrong for some clients), we don't do any control for av-pairs
in database - be carefull!


TACPPD MODIFYERS:
-----------------
for better AV handling we have system of AV modifyers.
The modifyers - interface to internal functions, SQL servers
and external programs to change values during request

- Internal functions:
set AVP as -
attribute=INT:function
the function currently available - addrpool=number
this is request to internal address pooling system
Example:   "addr=INT:addrpool=10"
(get address from address pool number 10)
for setting address pools see config file documentation

- SQL functions:
attribute=SQL:sql function request string
request to SQL for data. Get only first row value
Example:	"timeout=SQL:GetTimeoutFunction($name)"
it will requested as "SELECT GetTimeoutFunction(PppUserName)"
(this is example for PostgreSQL, for Oracle it will be
some differ), if i not mistake:
"SELECT GetTimeoutFunction(PppUserName) FROM DUAL"
(see Oracle documentation about calling PL/SQL functions)

External program:
attribute=EXT:external program request string
Example:	"timeout=EXT:get_timeout.pl"
or "timeout=EXT:get.pl $name"
NOTE: see BUGS file for status of bug 20010716
(currently this feature doesn't work)
The programs can be placed ONLY into "ext" subdirectory
in tacppd tree.

For sending information to external requests you can
use additional variables:
$name	- during this request this will be changed to current
username string
$port	- nas port name
$nas		- network access server
$phone	- phone string if it is dialup connection

Example:
"timeout=SQL:time_table_function('$name','$nas','$phone')"


COMMON AUTHORIZATION EXAMPLES:
------------------------------
usually any ISP with DIAL-UP services has several
authorization groups:

1. ordinary PPP with use NAS internal address pool
service=ppp		protocol=lcp
service=ppp		protocol=ip		addr-pool=DIALUP
# below only if users use terminals for insert username/password
# (some non-standard, advanced or stupid dial-up clients)
service=shell				cmd=
service=shell				autocmd=ppp
service=shell				noescape=true

2. group = username - for ppp with static ip addr
service=ppp		protocol=lcp
service=ppp		protocol=ip		addr=194.85.113.100

3. ppp with use tacppd internal ip addr pooling system
this is our addition, but for NAS it will be converted
to string "addr=address_from_pool_system"
service=ppp		protocol=lcp
service=ppp		protocol=ip		addr=INT:addrpool=1

4. ppp with additional ip filters
service=ppp		protocol=lcp
service=ppp		protocol=ip		addr-pool=DIALUP
service=ppp		protocol=ip		inacl#1=deny ip any 192.168.0.0 0.0.0.255
service=ppp		protocol=ip		inacl#2=permit ip any any

5. uucp (rlogin access to uucp server)
service=shell				cmd=
service=shell				autocmd=rlogin aaa.bbb.ru /user uuuser
service=shell				noescape=true

6. admin access (unrestricted)
service=shell				cmd=

7. async tunnel:
service=shell				cmd=
service=shell				autocmd=telnet 192.168.10.100 3162 /stream
service=shell				noescape=true

some comments:

a) if you use ppp multilink (for example, you have ISDN users),
you should add:
service=ppp		protocol=multilink	max-links=2

b) ppp callback service
service=ppp		protocol=lcp	callback-dialstring=
service=shell				callback-dialstring=
service=shell				nocallback-verify=1


EXAMPLES
--------
	
dial-in PPP with pool DIALUP
 service | protocol | av-pair
 --------+----------+------------------
   ppp   |   lcp    |
   ppp   |   ip     | addr-pool=DIALUP
   shell |          | cmd=
   shell |          | autocmd=ppp
   shell |          | noescape=true
 --------------------------------------
    
 dial-in PPP with pool DIALUP and for ISDN
 service | protocol | av-pair
 --------+----------+------------------
   ppp   |   lcp    |
   ppp   |   ip     | addr-pool=DIALUP
   ppp   |multilink | max-links=2
 --------------------------------------
    
 dial-in PPP with static ip addr
 service | protocol | av-pair
 --------+----------+------------------
   ppp   |   lcp    |
   ppp   |   ip     | addr=10.1.1.10
   shell |          | cmd=
   shell |          | autocmd=ppp
   shell |          | noescape=true
 --------------------------------------
    
 async tunneling
 service | protocol | av-pair
 --------+----------+--------------------------------------
   shell |          | cmd=
   shell |          | autocmd=telnet 192.168.1.112 /stream
   shell |          | noescape=true
 ----------------------------------------------------------

 shell connect (all commands)
 service | protocol | av-pair
 --------+----------+------------------
   shell |          | cmd=
 --------------------------------------

 connect for UUCP (autocommand)
 service | protocol | av-pair
 --------+----------+-----------------------------------------
  shell  |          | cmd=
  shell  |          | autocmd=rlogin smtp.aaa.ru /user uuuser
  shell  |          | noescape=true
 -------------------------------------------------------------

    shell connect with restricted command set
  	you should use PER-COMMAND AUTHORIZATION


PER-COMMAND AUTHORIZATION
-------------------------
description: per-command authorization for cmd= and cmd-arg= av-pairs
tablename: tp_cmdavp
	avpid			char(32)		-- authoriz group name --
	cmdperm		char(50)		-- regex with permitted command --
	cmddeny		char(50)		-- regex with deny command --
	argperm		char(50)		-- regex with permitted arguments --
	argdeny		char(50)		-- regex with deny arguments --

index:
CREATE INDEX tp_cmdavp_index ON tp_cmdavp (avpid);

.*		- all
[^.*]	- nothing

permit any commands and arguments
 cmdperm | cmddeny | argperm | argdeny
---------+---------+---------+---------
   .*    |         |    .*   |
---------+---------+---------+---------

deny any commands and arguments
 cmdperm | cmddeny | argperm | argdeny
---------+---------+---------+---------
         |   .*    |         |   .*
---------+---------+---------+---------


3. ACCOUNTING
-------------
description: log entries table (only stop entries)
tablename: tp_log
	server						char(16)			-- server --
	servtime						datetime			-- time in server --
	start_time					datetime			-- nas internal start time --
	task_id						int				-- nas task_id --
	username						char(32)			-- username --
	nas							char(16)			-- NAS --
	port							char(10)			-- nas port --
	service						char(10)			-- service --
	cfrom							char(64)			-- phone or ip addr --
	ip								char(16)			-- ip addr of client --
	protocol						char(10)			-- protocol --
	elapsed						int				-- elapsed time --
	bytes_in						int				-- bytes in port --
	bytes_out					int				-- bytes out from port --
	disc_cause					int				-- disconnect cause --
	disc_cause_ext				int				-- ext disconnect cause --
	rx_speed						int				-- connect read speed --
	tx_speed						int				-- connect write speed --
	h323_call_origin			char(10)			-- answer/originate/ --
	h323_call_type				char(15)			-- Telephony/ --
	h323_disconnect_cause	int				-- --
	h323_voice_quality		int				-- --
	h323_connect_time			datetime			-- --
	h323_disconnect_time		datetime			-- --
	h323_remote_address		char(16)			-- remote ip addr --

index:
CREATE UNIQUE INDEX tp_log_index ON tp_log (nas,port,start_time);


the tacppd store accounting information in two destinations:
1. text file
2. database
it stores all av-pairs wich it receives from NAS


4. STORE TRAFFIC INFORMATION
----------------------------
server can store ifInOctets/ifOutOctets information from NAS and routers.
This information collects from device during SNMP polling process.

description: traffic log via interface counters
tablename: tp_traffic
	server	char(16)		-- the server IP --
	curtime	datetime		-- time of entry --
	port		char(16)		-- info for port --
	nas		char(16)		-- on nas ip --
	bytein	float			-- ifInOctets --
	byteout	float			-- ifOutOctets --

CREATE UNIQUE INDEX t_traffic_index ON t_traffic (server,nas,port,curtime);


5. BILLING
----------
description: billing resource table description
tablename: tp_bilid
	bilid		char(32)		-- billing group --
	bilidname	char(50)		-- billing group name --
	bilres		int				-- resource module number --
index:
CREATE INDEX tp_bilid_index ON tp_bilid (bilid);

description: billing resource table
tablename: tp_bil
	bilid		char(32)			-- billing group --
	attribute	char(32)			-- attribute name --
	valuei		int					-- integer value --
	valuef		float				-- float value --
	values		char(32)			-- string value --
index:
CREATE INDEX tp_bil_index ON tp_bil (bilid);



COMMON EXAMPLES FOR DATABASE ENTRIES
====================================
		
---- Administrator access to NAS ----
---- (only via telnet/async terminal) ----
INSERT INTO tp_users(username,password,open,avpid,chkid,maxsess) VALUES
	('adm','crypted pwd',true,'adm','adm',1);
INSERT INTO tp_chk(chkid,phone,nas,port,time) VALUES
	('adm','.*','.*','^vty.*|^tty.*','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('adm','shell','','cmd=');

---- PPP user common (no ISDN) with pool DIALUP ----
INSERT INTO tp_users(username,password,open,avpid,chkid,maxsess) VALUES
	('Ppp0001','pwd',true,'ppp-asy');
INSERT INTO tp_chk(chkid,phone,nas,port,time)
	    VALUES('Ppp0001','.*','.*','^Asy.*','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
      ('ppp-asy','ppp','lcp','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
      ('ppp-asy','ppp','ip','addr-pool=DIALUP');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
      ('ppp-asy','shell','','cmd=');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
      ('ppp-asy','shell','','autocmd=ppp');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
      ('ppp-asy','shell','','noescape=true');

---- PPP user (ISDN only) 64/128K with pool DIALUP ----
INSERT INTO tp_users(username,password,open,avpid,chkid,maxsess) VALUES
	('Ppp0001','pwd',true,'ppp-isdn');
INSERT INTO tp_chk(chkid,phone,nas,port,time) VALUES
	('Ppp0001','.*','.*','^Se.*','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
      ('ppp-isdn','ppp','lcp','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
      ('ppp-isdn','ppp','ip','addr-pool=DIALUP');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
      ('ppp-isdn','multilink','max-links=2','');

---- PPP user with static IP (ISDN and Async) ----		
INSERT INTO tp_users(username,password,open,avpid,chkid,maxsess) VALUES
	('Ppp0001','pwd',true,'khb0001');
INSERT INTO tp_chk(chkid,phone,nas,port,time) VALUES
	('Ppp0001','.*','.*','^Asy.*','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('khb0001','ppp','lcp','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('khb0001','ppp','ip','addr=210.19.18.100');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('khb0001','multilink','max-links=2','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('khb0001','shell','','cmd=');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('khb0001','shell','','autocmd=ppp');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('khb0001','shell','','noescape=true');

---- PPP user with callback ----
INSERT INTO tp_users(username,password,open,avpid,chkid,maxsess) VALUES
	('Ppp0001','pwd',true,'ppp-asy');
INSERT INTO tp_chk(chkid,phone,nas,port,time) VALUES
	('Ppp0001','.*','.*','^Asy.*','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('ppp-asy','ppp','lcp','callback-dialstring=');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('ppp-asy','ppp','ip','addr-pool=DIALUP');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('ppp-asy','shell','','cmd=');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('ppp-asy','shell','','callback-dialstring=');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('ppp-asy','shell','','nocallback-verify=1');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('ppp-asy','shell','','autocmd=ppp');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('ppp-asy','shell','','noescape=true');

---- UUCP user for server N1 ----
---- with rlogin to uucp.aaa.ru ----
INSERT INTO tp_users(username,password,open,avpid,chkid,maxsess) VALUES
	('uuuser','nopassword',true,'uucp-aaa');
INSERT INTO tp_chk(chkid,phone,nas,port,time)
	VALUES('uuuser','.*','.*','^Asy.*','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('uucp-aaa','shell','','cmd=');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('uucp-aaa','shell','','autocmd=rlogin uucp.aaa.ru /user uuuser');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('uucp-aaa','shell','','noescape=true');

---- UUCP user for server N2 ----
---- with rlogin to uucp.bbb.ru ----
INSERT INTO tp_users(username,password,open,avpid,chkid,maxsess) VALUES
	('uuprk','nopassword',true,'uucp-prk');
INSERT INTO tp_chk(chkid,phone,nas,port,time) VALUES
	('uuprk','.*','.*','^Asy.*','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('uucp-prk','shell','','cmd=');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('uucp-prk','shell','','autocmd=rlogin uucp.bbb.ru /user uuprk');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('uucp-prk','shell','','noescape=true');

---- Admin access to one NAS (194.85.113.21) ----
---- only via telnet/async terminal ----
INSERT INTO tp_users(username,password,open,avpid,chkid,maxsess) VALUES
	('admin-voip','pwd',true,'adm-voip');
INSERT INTO tp_chk(chkid,phone,nas,port,time) VALUES
	('admin-voip','.*','^190.85.113.21$','^tty.*','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('adm-voip','shell','','cmd=');

---- Async tunneling (for bank card terminals, for example) ----
INSERT INTO tp_users(username,password,open,avpid,chkid,maxsess) VALUES
	('termcard','nopassword',true,'card');
INSERT INTO tp_chk(chkid,phone,nas,port,time) VALUES
	('termcard','.*','.*','^Asy.*','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('card','shell','','cmd=');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('card','shell','','autocmd=telnet 10.1.1.1 3162 /stream');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('card','shell','','noescape=true');

-- user DEFAULT for ll access --
-- you should add user DEFAULT if your NAS doesn't support --
-- separate authorization on several ports, if so - no need in this user --
INSERT INTO tp_users(username,password,open,avpid,chkid,maxsess) VALUES
	('DEFAULT','XXX',true,'DEFAULT',100,'');
INSERT INTO tp_chk(chkid,phone,nas,port,time) VALUES
	('DEFAULT','.*','.*','Asy.*|Se.*','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('DEFAULT','ppp','lcp','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('DEFAULT','ppp','ip','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('DEFAULT','slip','','');

-- user 111/... for telephony access --
INSERT INTO tp_users(username,password,open,avpid,chkid,maxsess) VALUES
	('111','crypted password',true,'voip',1,'');
INSERT INTO tp_chk(chkid,phone,nas,port,time) VALUES
	('111','.*','^194.85.113.21$','^FXO.*','');
INSERT INTO tp_avp(avpid,service,protocol,avp) VALUES
	('voip','connection','h323','h323-credit-time=10');


ADDITIONAL NOTES
================
The VoIP session (on FXO) logs 4 entries for all connections:
1. start from port
2. start from user connection
3. stop from user connection
4. stop from port
    
in 1 and 4 you can see FXO port number
also, opening ports doing authentication with username of
your pots peer number mask (3640 with FXO for example).
But it doesn't care about result of it.

==============================================================
Roman Volkov (rv@kht.ru)
