2.4.6 TACACS+ CLI Configuration

This guide explains how to configure TACACS+ (Terminal Access Controller Access-Control System Plus) and authentication for DSR CLI users with the tacacsCliAuthentication utility.

Administrators can create local TACACS managed users and assign SSH access, console access, or  both.

Scope
  • TACACS+ authentication, authorization, and accounting for SSH and console access.
  • TACACS+ authentication will be applicable only to new TACACS+ managed users. Default users such as admusr, root remain unaffected by TACACS+ authentication.
  • Access to sudo and other administrative commands for a TACACS+ managed users will be dependent on their group permissions. DSR provides mechanism to add TACACS+ managed users to system groups.
  • If both LDAP and TACACS+ authentication are configured, user accounts must match on LDAP and TACACS+. In such case, there is no need of creating user accounts through tacacsCliAuthentication tool.
  • One or more TACACS+ servers can be configured in the failover order.
  • IPv4 and IPv6 TACACS+ server configuration.
  • TACACS+ shared-secret configuration.
  • Local TACACS+ user creation with SSH and/or console access assignment.
  • TACACS+ server connectivity over TCP port 49.
  • For SSH, PAM (Pluggable Authentication Module) can fall back from TACACS+ to LDAP and then to local UNIX authentication, if user password is configured locally.
  • Configure both the DSR XMI or interface IP address and the DSR VIP as TACACS+ client entries on the TACACS+ server.
  • An LDAP user may be granted console access only when the TACACS+ server authenticates or authorizes that user. LDAP fallback from the DSR console PAM configuration is not supported.

Out of Scope

  • TACACS+ to LDAP fallback is supported for SSH access only; LDAP fallback and LDAP credential    authentication are not supported for console access.
  • TACACS+ TLS and mutual TLS are not supported; certificate, cipher-suite, TLS-version, and TLS- port configuration are unavailable, and the required shared secret does not provide TLS transport encryption.
  • IPv4-mapped IPv6 addresses, such as ::ffff:192.0.2.1, are rejected during validation.
  • Zone-qualified or link-local IPv6 addresses, such as fe80::1%eth0, must not be used because the zone identifier is ignored during address equivalence comparison, which can cause addresses on different interfaces to be treated as the same server.
  • Password aging and forced password changes are governed by external TACACS or LDAP policy.
  • Alarm and SNMP notification integration are not available. A dedicated TACACS+ connectivity diagnostic command is not available. Complete audit and compliance records rely on PAM, operating-system logs, TACACS+ accounting, and configured log-retention policies.