TACACS+¶

Overview¶

Where RADIUS authenticates your subscribers, TACACS+ authenticates the engineers who log in to the network gear itself — the routers, switches, and firewalls — then authorizes and records every command they run. MonsterOps can be the TACACS+ AAA server your devices point their aaa config at, implemented in pure Python with no extra daemon.

It's a separate, opt-in service on its own TCP port. It never touches RADIUS, the FreeRADIUS integration, or any device that isn't enrolled in it — turning it on cannot affect subscriber authentication.

Turning it on¶

TACACS+ is off by default. Set MONSTEROPS_TACACS_ENABLED=true and restart. The listener uses TCP 49, a privileged port — the systemd unit shipped by install.sh grants CAP_NET_BIND_SERVICE so the non-root service can bind it. If you'd rather not grant that, set MONSTEROPS_TACACS_PORT to a high port (>1024) and redirect 49 → that port at your firewall.

The TACACS+ workspace (under Network) is always visible, so you can configure clients and accounts before you flip the switch. A banner tells you whether the listener is actually running.

Where things are¶

• Clients — the network devices allowed to use MonsterOps as their TACACS+ server, each with its own shared secret (encrypted at rest, never shown again).
• Accounts — the device admins. Separate from both app admins and RADIUS subscribers.
• Accounting log — every login and authorized command, filterable by user and type.
• Each account's Policy — its ordered command-authorization rules.

Enrolling a device¶

Two ways, same result:

• From the device's NAS entry (recommended) — open the NAS under NAS, go to its Device admin tab, set a shared secret, and click Enable device admin. MonsterOps also generates the vendor aaa config snippet — Cisco IOS/IOS-XE, Arista EOS, Juniper Junos, Huawei VRP, or a generic checklist — to paste straight onto the box. The snippet carries a <shared-secret> placeholder; fill in the same secret you set.
• From the TACACS+ workspace — the Clients tab adds a device directly (name, IP or CIDR, shared secret).

Accounts¶

Each device-admin account authenticates one of two ways:

• Local password — a password stored (hashed) in MonsterOps.
• Directory (AD) delegation — a live bind against a Realms identity source, so engineers use their real Active Directory password and MonsterOps stores nothing.

Every account has a privilege level (0–15) returned at login.

Command policies¶

Open an account's Policy to build an ordered list of permit/deny rules. Each rule is a regular expression matched against the command line; rules are evaluated top-down and the first match wins. An account with no rules may run any command (its privilege level still applies); once any rule exists, a command that matches none is denied. So permit ^show followed by deny .* gives a read-only operator.

Accounting¶

The accounting log records every login (start/stop) and every authorized command — who, which device, privilege level, and the full command line — and fires a tacacs.command / tacacs.session_* event on the bus. That means the same Automation rules and webhooks that react to RADIUS events can react to device-admin activity too.

Hardening¶

The listener caps simultaneous connections (MONSTEROPS_TACACS_MAX_CONNECTIONS, default 256) and drops a peer that goes quiet mid-exchange (MONSTEROPS_TACACS_READ_TIMEOUT, default 30 s), so a device opening many stalled sessions can't exhaust it.