TACACS+ Console Policy

2.4.6.2.4 TACACS+ Console Policy

Use "Console Policy" to manage TACACS specific console session controls. These settings are separate from TACACS client configuration.

Configure -t <seconds> controls how long the TACACS client waits during login for an authentication response from the TACACS server. Console policy controls console or session behavior, such as idle timeout and maximum session duration for TACACS managed users.

Run the following command to show supported console policy options:

/usr/TKLC/appworks/bin/tacacsCliAuthentication console-policy list

Run the following command to show current console policy:

/usr/TKLC/appworks/bin/tacacsCliAuthentication console-policy show

Note:

--hostnames are optional.
With --hostnames, it targets only the specified host. Example: /usr/TKLC/appworks/bin/tacacsCliAuthentication --hostnames "<hostname>" console-policy show
Without --hostnames, it uses topology or default wrapper behavior and may run across all discovered servers. Example:
```
/usr/TKLC/appworks/bin/tacacsCliAuthentication console-policy list
```

Run the following command to configure console policy:

/usr/TKLC/appworks/bin/tacacsCliAuthentication [--hostnames <hostname1>[,<hostname2>]] console-policy -idleTimeout <SECONDS> -maxDuration <SECONDS>

Example:
/usr/TKLC/appworks/bin/tacacsCliAuthentication --hostnames "HOSTNAME1" console-policy -idleTimeout 120 -maxDuration 3600

The following table provides the console policy options:

Table 2-62 Console Policy options

Option	Description
-idleTimeout <SECONDS>	Sets shell idle timeout for TACACS managed console sessions.
-maxDuration <SECONDS>	Sets maximum console session duration for TACACS managed sessions.