TACACS+ NG

tac_plus-ng is a TACACS+ daemon that supports RADIUS, too. It provides networking components like routers and switches with authentication, authorisation and accounting services.

This version is a major rewrite of the original public Cisco source code and is in turn largely based on tac_plus, which comes with the same distribution. Key features include:

NAS specific device keys, prompts, enable passwords

Rule-based permission assignment

Flexible external back-ends for user profiles (e.g. via PERL scripts or C; LDAP (including ActiveDirectory), RADIUS and others are included)

Connection multiplexing (multiple concurrent NAS clients per process)

Session multiplexing (multiple concurrent sessions per connection, single-connection)

Scalable, no limit on users, clients or servers.

CLI context aware.

Full support for both IPv4 and IPv6

Implements and auto-detects HAProxy protocol 2.

Supports TLS

Compliant to RFC8907

Supports Linux VRFs

Supports (non-standard) SSH Public Key Authentication (see the Wiki for reference)

Implements and auto-detects legacy RADIUS (UDP and TCP), RADSEC (TLS) and RADIUS/DTLS (all with PAP authentication only).