TACACS+ SSH Policy

2.4.6.2.3 TACACS+ SSH Policy

Use "SSH Policy" to manage TACACS specific SSH session controls. These settings are separate from TACACS client configuration.

Configure -t <seconds> controls how long the TACACS client waits during login for an authentication response from the TACACS server. ssh-policy controls SSH/session behavior, such as idle timeout, SSH keep alive, concurrent session limits, and maximum session duration, for TACACS managed users.

Run the following command to show supported SSH policy options:

/usr/TKLC/appworks/bin/tacacsCliAuthentication ssh-policy list

Run the following command to show current SSH policy:

/usr/TKLC/appworks/bin/tacacsCliAuthentication ssh-policy show

Note:

--hostnames are optional.
With --hostnames, it targets only the specified host. Example: /usr/TKLC/appworks/bin/tacacsCliAuthentication --hostnames "<hostname>" ssh-policy show
Without --hostnames, it uses topology or default wrapper behavior and may run across all discovered servers. Example:
```
/usr/TKLC/appworks/bin/tacacsCliAuthentication ssh-policy list
```

Run the following command to configure SSH policy:

/usr/TKLC/appworks/bin/tacacsCliAuthentication [--hostnames <hostname1>[,<hostname2>]] ssh-policy -idleTimeout <SECONDS> -clientAliveInterval <SECONDS> -clientAliveCountMax <COUNT> -maxLogins <COUNT> -maxDuration <SECONDS>

/usr/TKLC/appworks/bin/tacacsCliAuthentication --hostnames "HOSTNAME1" ssh-policy -idleTimeout 120 -clientAliveInterval 60 -clientAliveCountMax 2 -maxLogins 5 -maxDuration 3600

The following table provides the SSH policy options:

Table 2-61 SSH Policy options

Option	Description
-idleTimeout <SECONDS>	Sets shell idle timeout for TACACS managed SSH sessions.
-clientAliveInterval <SECONDS>	Sets `sshd` `ClientAliveInterval` for TACACS managed SSH sessions.
-clientAliveCountMax <COUNT>	Sets `sshd` `ClientAliveCountMax` for TACACS-managed SSH sessions.
-maxLogins <COUNT>	Limits concurrent logins for the TACACS group.
-maxDuration <SECONDS>	Sets maximum SSH session duration for TACACS managed sessions.