TACACS+ (Terminal Access Controller Access Control System Plus) is a protocol that provides centralized authentication, authorization, and accounting (AAA) services for network devices. It is commonly used in corporate environments to authenticate and authorize access to network devices such as routers, switches, and firewalls.
In this article, we will discuss how to configure a TACACS+ server on Ubuntu 16.04. We will cover the installation and configuration of the TACACS+ server, as well as the configuration of the clients to use the TACACS+ server for authentication and authorization.
Installing TACACS+
The first step in configuring TACACS+ is to install the TACACS+ server software. The TACACS+ server is available in the Ubuntu repositories, so it can be easily installed using the apt package manager. First, we need to update the package index and then install the tacacs+ package:
$ sudo apt update
$ sudo apt install tacacs+
Once the installation is complete, the TACACS+ server is ready to be configured.
Configuring TACACS+
The TACACS+ server is configured by editing the /etc/tacacs+/tacacs+ server configuration file. The configuration file contains settings for the server, users, and other parameters.
The first setting that needs to be configured is the TACACS+ server key. This is a shared secret that is used to encrypt communications between the TACACS+ server and clients. The server key should be a long and random string.
Next, we need to configure the users that will be allowed to authenticate to the TACACS+ server. Each user should have a username, password, and group membership. The group membership can be used to control access to specific network devices or services.
The last step is to configure the network devices that will use the TACACS+ server for authentication and authorization. This is done by specifying the IP address of the TACACS+ server and the shared secret.
Configuring Clients to Use TACACS+
Once the TACACS+ server is configured, clients need to be configured to use the TACACS+ server for authentication and authorization. This is done by specifying the IP address of the TACACS+ server and the shared secret.
The configuration of the clients will vary depending on the type of client and the network device that it is connecting to. For example, the configuration of a Cisco router to use the TACACS+ server will be different than the configuration of a Linux client to use the TACACS+ server.
For Cisco routers, the configuration is typically done in the router's configuration mode. The commands used to configure the router to use the TACACS+ server will be similar to the following:
tacacs-server host
tacacs-server key
tacacs-server timeout
For Linux clients, the configuration is typically done in the /etc/pam.d/system-auth configuration file. The configuration will be similar to the following:
auth required pam_tacplus.so
account required pam_tacplus.so
Once the configuration is complete, the clients will be able to authenticate and authorize access to the network devices using the TACACS+ server.
Conclusion
In this article, we discussed how to configure a TACACS+ server on Ubuntu 16.04. We covered the installation and configuration of the TACACS+ server, as well as the configuration of the clients to use the TACACS+ server for authentication and authorization. By configuring a TACACS+ server, IT administrators can provide centralized authentication and authorization for their network devices.
