tacacs

Pre-Alpha. This page describes behavior that may change.

Ze authenticates SSH logins against TACACS+ servers (RFC 8907) when the system.authentication.tacacs block is present. Local bcrypt users keep working as the fallback so an unreachable server cannot lock you out of the device.

What it does

Function	Status	Notes
Authentication	Production	PAP (login over the SSH password callback).
Accounting	Production	START + STOP records around every dispatched CLI command.
Authorization	Wired	authorization true switches per-command authorization on.

Configuration

system {
    authentication {
        tacacs {
            server 10.0.0.1 { port 49; key "$9$encrypted-key"; }
            server 10.0.0.2 { port 49; key "$9$encrypted-key"; }
            timeout 5;
        }
        tacacs-profile 15 { profile [ admin ]; }
        tacacs-profile 1  { profile [ read-only ]; }
    }
    authorization {
        profile admin     { run { default-action allow; } edit { default-action allow; } }
        profile read-only { run { default-action allow; } edit { default-action deny;  } }
    }
}

Leaf	Type	Default	Notes
tacacs.server <ip>	list	-	Tried in declaration order on failure.
tacacs.server <ip>.port	uint16	49	TCP port.
tacacs.server <ip>.key	string	required	Shared secret, stored as $9$ ciphertext.
tacacs.timeout	uint16	5	Per-server connection timeout in seconds.
tacacs.source-address	ip-address	none	Local source IP for outbound connections.
tacacs.authorization	boolean	false	Enable per-command authorization.
tacacs.accounting	boolean	false	Enable START/STOP accounting records.
tacacs-profile <N>.profile	leaf-list	required	Maps priv-lvl N (0-15) to local authz profiles.

Authentication flow

1. SSH client connects with username + password.
2. AAA chain calls TACACS+ authenticator first (priority 100; local bcrypt is priority 200).
3. Client opens TCP to the first configured server, sends a PAP AUTHEN START.
4. PASS: priv-lvl from reply maps to tacacs-profile. Unmapped levels reject the login.
5. FAIL: explicit rejection. Local bcrypt is NOT tried.
6. Connection error / ERROR: next server tried. When all servers fail, chain falls through to local bcrypt.

Privilege level mapping

TACACS+ servers send a numeric priv-lvl (0-15). Ze's internal authorization model is name-based, so each level must be mapped to local system.authorization.profile entries.

priv-lvl	Common convention	Example
15	Full administrator	profile [ admin ]
5	Site operator	profile [ operator ]
1	Read-only / NOC	profile [ read-only ]

Unmapped levels reject the login. Check the daemon log for TACACS+ unmapped privilege level.

What the mapped profiles govern

The mapped profiles decide every command the session may run, not just whether the login succeeds. Ze resolves them once at authentication and authorizes each command against them, so tacacs-profile 1 { profile [ read-only ]; } gives that session exactly what the local read-only profile allows and refuses the rest with command restricted by access control.

Only the profile names are fixed at login. Each command is evaluated against the profile as it is defined at that moment, so editing read-only and committing applies to sessions already open, without a reconnect.

Authorization is fail-closed. A login that resolves to no usable authorization profile is denied rather than admitted with no privileges, and a tacacs-profile naming a profile that is not defined under system.authorization is rejected. An authenticated session always carries at least one resolvable profile.

A local system.authentication.user block with the same username takes precedence over the mapped profiles: an explicit local assignment is a stated intent for that name, so it is not widened or narrowed by how the user logged in.

Setting authorization true moves the per-command decision to the TACACS+ server itself: Ze sends an AUTHOR REQUEST per command, and the profiles above apply only as the fallback when the server is unreachable, unless strict-fallback true makes that case deny.

Accounting

When accounting true is set, every CLI command emits START and STOP records to the TACACS+ server. Records are queued to a background worker. Accounting failures are logged but never block the command.

Operational notes

• Shared secrets are stored as $9$-encoded ciphertext, never plaintext.
• VRF context is inherited from the SSH server.
• Single-connect mode (RFC 8907 S4.4) is not negotiated; each exchange opens its own TCP connection.

See also

• In-tree TACACS+ guide for the full reference.
• System for user management and authorization profiles.

Adapted from main/docs/guide/tacacs.md.