Table of Contents
Ubuntu Tacacs+ Server
Tacacs+ is a TCP based entirely new protocol used for AAA nowadays. This new protocol is not compatible with its previous versions like Tacacs and Xtacacs. With the help of Tacacs+ you can set up much more granular level access for the users, groups, subnets or device type etc.
Tacacs+ is an open-standard protocol compatible across various networking equipment vendor platforms.
Related – TACACS VS TACACS+
If you are one of the guys wanting to test some access restriction with Tacacs+ in a lab but don’t have a licensed product, then we will help you set up a Tacas+ server on your Linux-based Ubuntu machine by editing the tac_plus.conf file.
On the newer version of Ubuntu, you can easily install tacacs+ package from the apt-get repository which will also install libtacacs+1.
Step 1
Run command: sudo apt-get install tacacs+
lab@lab_VM1:~$ sudo apt-get install tacacs+
[sudo] password for lab:
Reading package lists… Done
Building dependency tree
Reading state information… Done
The following extra packages will be installed:
libtacacs+1
The following NEW packages will be installed
libtacacs+1 tacacs+Step 2
Once the package is installed successfully you can view the location of the tac_plus.conf file using command
lab@lab_VM1:~$ ps -ef | grep tac_plus
root 1220 1 0 12:37 ? 00:00:00 /usr/sbin/tac_plus -C /etc/tacacs+/tac_plus.conf
lab 22730 2682 0 14:55 pts/0 00:00:00 grep –color=auto tac_plusStep 3
Now we will proceed to edit the tac_plus.conf file but before that we must backup to original file to refer to in case anything breaks.
lab@lab_VM1:~$ sudo cp /etc/tacacs+/tac_plus.conf /etc/tacacs+/tac_plus.conf.oldStep 4
Next we have to create a file on which the accounting information will be written to. This is done with the help of below command.
sudo touch /var/log/tac_plus.acctStep 5
In this step we will edit the tac_plus.conf file at below location.
sudo nano /etc/tacacs+/tac_plus.confThe tac_plus.conf file looks like below:
sudo nano /etc/tacacs+/tac_plus.conf# Created by Henry-Nicolas Tourneur(henry.nicolas@tourneur.be)
# See man(5) tac_plus.conf for more details
# Define where to log accounting data, this is the default.
accounting file = /var/log/tac_plus.acct
# This is the key that clients have to use to access Tacacs+
key = testing123# We also can define local users and specify a file where data is stored.
# That file may be filled using tac_pwd
#Defining the users, we have two users defined one admin and other ipwithease. Admin will have full access while another user will have limited access.
user= Administrator {
login = cleartext Cisco
member = “admin”
}
user = ipwithease {
login = cleartext “cisco”
enable = cleartext “cisco”
member = readonly
}#Defining the groups now to which members have been assigned above. Two groups are created admin and readonly.
group = admin {
default service = permit
service = exec {
default attribute = permit
priv-lvl = 15
}
}
group = readonly {
default service = deny
service = exec {
default attribute = permit
priv-lvl = 15
}
}
cmd = show {
# permit show commands
permit .*
}
# permit traceroute command
cmd = traceroute {
permit .*
}
# permit ping command
cmd = ping {
permit .*
}Hence in the above file, we have created two TACACs+ users.
User Administrator has the complete access and the user ipwithease has limited access and can run only the show commands, traceroute and ping commands.
Once you’re finished with everything you can run service tacacs_plus check to make sure the syntax is correct and if you get any errors you will need to restart the daemon using service tacacs_plus restart.
Related Troubleshoot Scenarios
Installation and Configuration Issues
How do I install the TACACS+ server on Ubuntu?
- Ensure you have the necessary repositories added.
- Use sudo apt-get install tacacs+ to install the server.
- Check the installation with tac_plus -v.
How do I configure the TACACS+ server?
- Edit the configuration file located at /etc/tacacs+/tac_plus.conf.
- Ensure you define users, groups, and key parameters correctly.
How do I start or restart the TACACS+ service?
- Use sudo systemctl start tacacs+ to start.
- Use sudo systemctl restart tacacs+ to restart.
- Check the status with sudo systemctl status tacacs+.
Authentication Issues
Why are my users unable to authenticate?
- Check if the users are correctly defined in /etc/tacacs+/tac_plus.conf.
- Verify the shared secret between the client device and TACACS+ server.
- Ensure the client device’s IP address is allowed in the configuration.
How do I debug authentication issues?
- Enable logging in the TACACS+ configuration file.
- Check the log files usually located at /var/log/tac_plus.log.What could cause authentication timeouts?
- Network connectivity issues between the client and the server.
- High server load causing delays.
- Incorrect shared secret causing repeated failed attempts.
Permissions and Access Control Issues
How do I set up command authorization?
- Define cmd attributes under each user or group in /etc/tacacs+/tac_plus.conf.
- Example:
user = example {
service = exec {
priv-lvl = 15
}
cmd = show {
permit .*
}
cmd = configure {
permit terminal
}
}Why are my command authorizations not working?
- Ensure the syntax in the configuration file is correct.
- Verify that the user’s privilege level matches the command requirements.
- Restart the TACACS+ service after making changes.
Network and Connectivity Issues
How do I check if the TACACS+ server is reachable?
- Use ping to check connectivity.
- Use telnet or nc to test connectivity on port 49 (default TACACS+ port).
What can cause the TACACS+ server to be unreachable?
- Firewall settings blocking port 49.
- Network issues such as routing problems.
- The TACACS+ service is not running.
Logging and Monitoring
How do I enable detailed logging?
- In the configuration file, set accounting file = /var/log/tac_plus.acct.
- Use debug options for more detailed logs:
debug = file /var/log/tac_plus.debugWhere are the TACACS+ logs stored?
- By default, logs can be found in /var/log/tac_plus.log or as specified in the configuration file.
General Issues
How do I check the TACACS+ server version?
- Use tac_plus -v to check the version.
How do I upgrade the TACACS+ server?
- Use sudo apt-get update followed by sudo apt-get upgrade tacacs+.
How do I troubleshoot general TACACS+ issues?
- Check system logs using journalctl -u tacacs+.
- Verify configuration syntax using tac_plus -C /etc/tacacs+/tac_plus.conf.
ABOUT THE AUTHOR
