gong - Device connector¶
About¶
go Go connects to network devices and automatically logs you in using cached TACACS credentials. It supports telnet, SSHv1/v2.
PLEASE NOTE: go is still named gong (aka “Go NG”) within the Trigger packaging due to legacy issues with naming conflicts. This will be changing in the near future.
Usage¶
Here is the usage output:
% gong
Usage: gong [options] [device]
Automatically log into network devices using cached TACACS credentials.
Options:
-h, --help show this help message and exit
-o, --oob Connect to device out of band first.
Examples¶
Caching credentials¶
If you haven’t cached your credentials, you’ll be prompted to:
% gong test2-abc
Connecting to test2-abc.net.aol.com. Use ^X to exit.
/home/jathan/.tacacsrc not found, generating a new one!
Updating credentials for device/realm 'tacacsrc'
Username: jathan
Password:
Password (again):
Fetching credentials from /home/jathan/.tacacsrc
test2-abc#
This functionality is provided by Tacacsrc
.
Connecting to devices¶
Using gong is pretty straightforward if you’ve already cached your credentials:
% gong test1-abc
Connecting to test1-abc.net.aol.com. Use ^X to exit.
Fetching credentials from /home/jathan/.tacacsrc
--- JUNOS 10.0S8.2 built 2010-09-07 19:55:32 UTC
jathan@test1-abc>
Full or partial hostname matches are also acceptable:
% gong test2-abc.net.aol.com
Connecting to test2-abc.net.aol.com. Use ^X to exit.
If there are multiple matches, you get to choose:
% gong test1
3 possible matches found for 'test1':
[ 1] test1-abc.net.aol.com
[ 2] test1-def.net.aol.com
[ 3] test1-xyz.net.aol.com
[ 0] Exit
Enter a device number: 3
Connecting to test1-xyz.net.aol.com. Use ^X to exit.
If a partial name only has a single match, it will connect automatically:
% gong test1-a
Matched 'test1-abc.net.aol.com'.
Connecting to test1-abc.net.aol.com. Use ^X to exit.
Out-of-band support¶
If a device has out-of-band (OOB) terminal server and ports specified within
NetDevices
, you may telnet to the console by using
the -o
flag:
% gong -o test2-abc
OOB Information for test2-abc.net.aol.com
telnet ts-abc.oob.aol.com 1234
Connecting you now...
Trying 10.302.134.584...
Connected to test2-abc.net.aol.com
Escape character is '^]'.
User Access Verification
Username:
Executing commands upon login¶
You may create a .gorc
file in your home directory, in which you may
specify commands to be executed upon login to a device. The commands are
specified by the vendor name. Here is an example:
; .gorc - Example file to show how .gorc would work
[init_commands]
; Specify the commands you would like run upon login for each vendor name. The
; vendor name must match the one found in the CMDB for the manufacturer of the
; hardware. Currently these are:
;
; A10: a10
; Arista: arista
; Brocade: brocade
; Cisco: cisco
; Citrix: citrix
; Dell: dell
; Foundry: foundry
; Juniper: juniper
;
; Format:
;
; vendor:
; command1
; command2
;
juniper:
request system reboot
set cli timestamp
monitor start messages
show system users
cisco:
term mon
who
arista:
python-shell
foundry:
show clock
brocade:
show clock
(You may also find this file at configs/gorc.example
within the Trigger source
tree.)
Notice for Juniper one of the commands specified is request system
reboot
. This is bad! But don’t worry, only a very limited subset of root
commands are allowed to be specified within the .gorc
, and these are:
get
monitor
ping
set
show
term
terminal
traceroute
who
whoami
Any root commands not permitted will be filtered out prior to passing them along to the device.
Here is an example of what happens when you connect to a Juniper
device
with the specified commands in the sample .gorc
file displayed above:
% gong test1-abc
Connecting to test1-abc.net.aol.com. Use ^X to exit.
Fetching credentials from /home/jathan/.tacacsrc
--- JUNOS 10.0S8.2 built 2010-09-07 19:55:32 UTC
jathan@test1-abc> set cli timestamp
Mar 28 23:05:38
CLI timestamp set to: %b %d %T
jathan@test1-abc> monitor start messages
jathan@test1-abc> show system users
Jun 28 23:05:39
11:05PM up 365 days, 13:44, 1 user, load averages: 0.09, 0.06, 0.02
USER TTY FROM LOGIN@ IDLE WHAT
jathan p0 awesome.win.aol.com 11:05PM - -cli (cli)
jathan@test1-abc>
Troubleshooting¶
Authentication failures¶
If gong
fails to connect, it tries to tell you why, and in the event of an
authentication failure it will give you the opportunity to update your stored
credentials:
Fetching credentials from /home/j/jathan/.tacacsrc
Connection failed for the following reason:
'\n\n% Authentication failed.\n\n\nUser Access Verification\n\nUsername:'
Authentication failed, would you like to update your password? (Y/n)
Blank passwords¶
When initially caching credentials, your password cannot be blank. If you try,
gong
complains:
Updating credentials for device/realm 'tacacsrc'
Username: jathan
Password:
Password (again):
Password cannot be blank, try again!
If gong
detects a blank password in an existing .tacacsrc
file, it will force you to update it:
Missing password for 'aol', initializing...
Updating credentials for device/realm 'aol'
Username [jathan]: