tacacs log

Thu Oct 23 11:20:47 2014 [7429]: connect from x.x.x.x [x.x.x.x]
Thu Oct 23 11:20:47 2014 [7429]: Waiting for packet
Thu Oct 23 11:20:47 2014 [7429]: Read AUTHEN/START size=42
Thu Oct 23 11:20:47 2014 [7429]: validation request from x.x.x.x
Thu Oct 23 11:20:47 2014 [7429]: PACKET: key= i changed this one for you :) usually here comes the secret in cleartext
Thu Oct 23 11:20:47 2014 [7429]: version 192 (0xc0), type 1, seq no 1, flags 0x1
Thu Oct 23 11:20:47 2014 [7429]: session_id 508300234 (0x1e4c0bca), Data length 30 (0x1e)
Thu Oct 23 11:20:47 2014 [7429]: End header
Thu Oct 23 11:20:47 2014 [7429]: type=AUTHEN/START, priv_lvl = 0
Thu Oct 23 11:20:47 2014 [7429]: action=login
Thu Oct 23 11:20:47 2014 [7429]: authen_type=ascii
Thu Oct 23 11:20:47 2014 [7429]: service=login
Thu Oct 23 11:20:47 2014 [7429]: user_len=5 port_len=5 (0x5), rem_addr_len=12 (0xc)
Thu Oct 23 11:20:47 2014 [7429]: data_len=0
Thu Oct 23 11:20:47 2014 [7429]: User:
Thu Oct 23 11:20:47 2014 [7429]: horst
Thu Oct 23 11:20:47 2014 [7429]: port:
Thu Oct 23 11:20:47 2014 [7429]: tty12
Thu Oct 23 11:20:47 2014 [7429]: rem_addr:
Thu Oct 23 11:20:47 2014 [7429]: 10.32.67.103
Thu Oct 23 11:20:47 2014 [7429]: data:
Thu Oct 23 11:20:47 2014 [7429]: End packet
Thu Oct 23 11:20:47 2014 [7429]: Authen Start request
Thu Oct 23 11:20:47 2014 [7429]: choose_authen chose default_fn
Thu Oct 23 11:20:47 2014 [7429]: Calling authentication function
Thu Oct 23 11:20:47 2014 [7429]: Writing AUTHEN/GETPASS size=28
Thu Oct 23 11:20:47 2014 [7429]: PACKET: key= i changed this one for you :) usually here comes the secret in cleartext
Thu Oct 23 11:20:47 2014 [7429]: version 192 (0xc0), type 1, seq no 2, flags 0x1
Thu Oct 23 11:20:47 2014 [7429]: session_id 508300234 (0x1e4c0bca), Data length 16 (0x10)
Thu Oct 23 11:20:47 2014 [7429]: End header
Thu Oct 23 11:20:47 2014 [7429]: type=AUTHEN status=5 (AUTHEN/GETPASS) flags=0x1
Thu Oct 23 11:20:47 2014 [7429]: msg_len=10, data_len=0
Thu Oct 23 11:20:47 2014 [7429]: msg:
Thu Oct 23 11:20:47 2014 [7429]: Password:
Thu Oct 23 11:20:47 2014 [7429]: data:
Thu Oct 23 11:20:47 2014 [7429]: End packet
Thu Oct 23 11:20:47 2014 [7429]: Waiting for packet
Thu Oct 23 11:20:47 2014 [7429]: Read AUTHEN/CONT size=21
Thu Oct 23 11:20:47 2014 [7429]: PACKET: key= i changed this one for you :) usually here comes the secret in cleartext
Thu Oct 23 11:20:47 2014 [7429]: version 192 (0xc0), type 1, seq no 3, flags 0x1
Thu Oct 23 11:20:47 2014 [7429]: session_id 508300234 (0x1e4c0bca), Data length 9 (0x9)
Thu Oct 23 11:20:47 2014 [7429]: End header
Thu Oct 23 11:20:47 2014 [7429]: type=AUTHEN/CONT
Thu Oct 23 11:20:47 2014 [7429]: user_msg_len 4 (0x4), user_data_len 0 (0x0)
Thu Oct 23 11:20:47 2014 [7429]: flags=0x0
Thu Oct 23 11:20:47 2014 [7429]: User msg:
Thu Oct 23 11:20:47 2014 [7429]: bein  <<<< this is the freaking user input during password prompt
Thu Oct 23 11:20:47 2014 [7429]: User data:
Thu Oct 23 11:20:47 2014 [7429]: End packet
Thu Oct 23 11:20:47 2014 [7429]: login query for 'horst' port tty12 from x.x.x.x rejected
Thu Oct 23 11:20:47 2014 [7429]: login failure: horst x.x.x.x (x.x.x.x) tty12
Thu Oct 23 11:20:47 2014 [7429]: Writing AUTHEN/FAIL size=18
Thu Oct 23 11:20:47 2014 [7429]: PACKET: key= i changed this one for you :) usually here comes the secret in cleartext
Thu Oct 23 11:20:47 2014 [7429]: version 192 (0xc0), type 1, seq no 4, flags 0x1
Thu Oct 23 11:20:47 2014 [7429]: session_id 508300234 (0x1e4c0bca), Data length 6 (0x6)
Thu Oct 23 11:20:47 2014 [7429]: End header
Thu Oct 23 11:20:47 2014 [7429]: type=AUTHEN status=2 (AUTHEN/FAIL) flags=0x0
Thu Oct 23 11:20:47 2014 [7429]: msg_len=0, data_len=0
Thu Oct 23 11:20:47 2014 [7429]: msg:
Thu Oct 23 11:20:47 2014 [7429]: data:
Thu Oct 23 11:20:47 2014 [7429]: End packet
Thu Oct 23 11:20:47 2014 [7429]: x.x.x.x: disconnect