User/NAS Import Options
This feature allows changes either online or offline, and allows updating of the CS ACS database with a colon-delimited file. The following are the actions available for user and NAS:
Users: add, change, and delete
NAS: add and delete
You must restart CSRadius and CSTacacs for changes to take effect.
The following are some of the important points about importing:
The first line must contain ONLINE or OFFLINE.
This determines if the CSAuth service needs to be stopped during this process.
CSUtils cannot distinguish between multiple instances of an external database.
CSUtil will use the first instance of an external database.
Import User Information
You can add users to the existing database with the entry shown in Example 13-17. This entry adds the user Joe to group 2 in the CS ACS database. It also points authentication for this user to the internal CS ACS database with a password of my1Password.
Example 13-17. Adding a User to CS ACS
ADD:Joe:PROFILE:2:CSDB:my1Password
To change the CS ACS profile for Joe, use the command shown in Example 13-18. This entry updates Joe to group 3 and points the password to the NT domain database.
Example 13-18. Updating a User to CS ACS
UPDATE:Joe:PROFILE:3:EXT_NT
The DELETE entry can be used to delete users as shown in Example 13-19.
Example 13-19. Deleting a User from CS ACS
DELETE:Joe
Import NAS Information
Use the entry shown in Example 13-20 to add an NAS to the CS ACS database. This entry adds the router named router1, using the shared secret of my1NAS. This NAS will use RADIUS.
Example 13-20. Adding NAS
ADD_NAS:router1:IP:10.10.10.10:KEY:my1NAS:VENDER:"RADIUS (Cisco IOS/PIX)"
If you need to delete a specific NAS, use the command shown in Example 13-21, which deletes NAS router1.
Example 13-21. How to Delete a Specific NAS
DEL_NAS:router1
You can also choose to run all the previously shown procedures using a single text file. Example 13-22 shows a sample text file that contains multiple actions for different users.
Example 13-22. import.txt File Whose Content Can Be Imported Once
OFFLINE
ADD:user01:CSDB:userpassword:PROFILE:1
ADD:user02:EXT_NT:PROFILE:2
ADD:chapuser:CSDB:hello:CHAP:chappw:PROFILE:3
ADD:mary:EXT_NT:CHAP:achappassword
ADD:joe:EXT_SDI
ADD:user4:CSDB:user4password
ADD:user5:CSDB_UNIX:unixpassword
UPDATE:user9:PROFILE:10
DELETE:user10
ADD_NAS:router1:IP:10.10.10.10:KEY:my1NAS:VENDOR:"TACACS+ (Cisco
IOS)":NDG:"California"
DEL_NAS:router2
Compact User Database
When you delete a user from the CS ACS database, the record is marked as deleted. You might need to compact the database to actually remove the "deleted records". Compacting the database addresses this issue. When you compact a database, it first dumps the data, then creates a new database, and finally imports all the data that was dumped earlier. The following is the syntax for compacting a database:
csutil.exe -q -d n -l
Example 13-23 shows the sample of database compact run.
Example 13-23. Sample Database Compact Command
C:\Program Files\CiscoSecure ACS v3.3\Utils>net stop CSAuth
The CSAuth service is stopping.
The CSAuth service was stopped successfully.
C:\Program Files\CiscoSecure ACS v3.3\Utils>csutil -q -d -n -l
CSUtil v3.3(2.2), Copyright 1997-2004, Cisco Systems Inc
Done
Initializing database....
Done
Initializing database...
Loading database from dump.txt...
Done
C:\Program Files\CiscoSecure ACS v3.3\Utils>
Export User and Group Information
Export User and Group Information may be useful for troubleshooting the configuration issue by Cisco support. You will need to stop CSAuth before exporting this information.
To export user information to users.txt, enter the following command:
csutil.exe u
To export group information to groups.txt, enter the following command:
csutil.exe g
Other features of CSUtil.exe include the following:
Export Registry information to setup.txt.
Decode CS ACS internal error codes.
Recalculate Cyclic Redundancy Check (CRC) values for manually copied files.
Import user-defined RADIUS vendors and VSA sets.