tac_plus-ng is a TACACS+ daemon that supports RADIUS, too. It provides networking components like routers and switches with authentication, authorisation and accounting services.
This version is a major rewrite of the original public Cisco source code and is in turn largely based on tac_plus, which comes with the same distribution. Key features include:
NAS specific device keys, prompts, enable passwords
Rule-based permission assignment
Flexible external back-ends for user profiles (e.g. via PERL scripts or C; LDAP (including ActiveDirectory), RADIUS and others are included)
Connection multiplexing (multiple concurrent NAS clients per process)
Session multiplexing (multiple concurrent sessions per connection, single-connection)
Scalable, no limit on users, clients or servers.
CLI context aware.
Full support for both IPv4 and IPv6
Implements and auto-detects HAProxy protocol 2.
Supports TLS
Compliant to RFC8907
Supports Linux VRFs
Supports (non-standard) SSH Public Key Authentication (see the Wiki for reference)
Implements and auto-detects legacy RADIUS (UDP and TCP), RADSEC (TLS) and RADIUS/DTLS (all with PAP authentication only).