Tacacs+ is a TCP based entirely new protocol used for AAA nowadays. This new protocol is not compatible with its previous version like Tacacs and Xtacacs. With the help of Tacacs+ you can setup a much more granular level access for the users, groups, subnets or device type etc. Tacacs+ is an open-standard protocol compatible across various networking equipment vendor platforms.
If you are one of the guy wanting to test some access restriction with Tacacs+ in a labbut don’t have a licensed product, then we will help you setup a Tacas+ server on your linux-based Ubuntu machine by editing the tac_plus.conf file.
On the newer version of Ubuntu you can easily install tacacs+ package from apt-get repository which will also install libtacacs+1.
Step 1: Run command: sudo apt-get install tacacs+
Step 2: Once the package is installed successfully you can view the location of the tac_plus.conf file using command
Step 3: Now we will proceed to edit the tac_plus.conf file but before that we must backup to original file to refer to in case anything breaks.
Step 4: Next we have to create a file on which the accounting information will be written to. This is done with the help of below command.
Step 5: In this step we will edit the tac_plus.conf file at below location.
The tac_plus.conf file looks like below:
lab@lab_VM1:~$ cat /etc/tacacs+/tac_plus.conf
# Created by Henry-Nicolas Tourneur(firstname.lastname@example.org)
# See man(5) tac_plus.conf for more details
# Define where to log accounting data, this is the default.
accounting file = /var/log/tac_plus.acct
# This is the key that clients have to use to access Tacacs+
# We also can define local users and specify a file where data is stored.
# That file may be filled using tac_pwd
#Defining the users, we have two users defined one admin and other ipwithease. Admin will have full access while other user will have limited access.
#Defining the groups now to which members have been assigned above. Two groups are created admin and readonly.
Hence in the above file we have created two TACACs+ users.
User Administrator has the complete access and the user ipwithease has limited access and can run only the show commands, traceroute and ping commands.
Once you’re finished with everything you can run service tacacs_plus check to make sure the syntax is correct and if you get any errors you will need to restart the daemon using service tacacs_plus restart.