Skip to content

tac_plus‐ng: RADIUS support

Jump to bottom
Marc Huber edited this page Oct 7, 2025 · 3 revisions

RADIUS PAP/CHAP/MSCHAPv1/MSCHAPv2 authentication support is implemented for various RADIUS transports (TCP, UDP, TLS, DTLS). This should be sufficient to grant administrative access to users on devices supporting RADIUS but not TACACS+.

See

https://raw.githubusercontent.com/MarcJHuber/event-driven-servers/refs/heads/master/tac_plus-ng/sample/radius-dict.cfg

https://raw.githubusercontent.com/MarcJHuber/event-driven-servers/refs/heads/master/tac_plus-ng/sample/tac_plus-ng-radius.cfg

https://raw.githubusercontent.com/MarcJHuber/event-driven-servers/refs/heads/master/tac_plus-ng/sample/tac_plus-ng-radsec.cfg

https://raw.githubusercontent.com/MarcJHuber/event-driven-servers/refs/heads/master/tac_plus-ng/sample/tac_plus-ng-radius-mavis.cfg

https://raw.githubusercontent.com/MarcJHuber/event-driven-servers/refs/heads/master/tac_plus-ng/sample/tac_plus-ng-radius-mavis.cfg

for sample configurations.

Summary for legacy RADIUS:

  • Add listen { port = 1812 protocol = UDP } (and eventually a similar statement with 1813, but sending accounting packets to 1812 works, too) to the spawnd section. Then, in the tac_plus-ng section:
  • Import a RADIUS dictionary. This is custom-made, any existing ones won't match. Have a look at radius-dict.cfg for syntax, and extend it if needed.
  • Change configuration scripts to handle RADIUS. E.g., you can check with if (aaa.protocol == tacacs) for TACACS+, and, likewise, if (aaa.protocol == radius) is a suitable condition for RADIUS. RADIUS attributes can be queried via radius[attribute] syntax, e.g. if (radius[Service-Type] == Administrative-User), and you can set response attributes using set radius[attribute] = value, e.g.: set radius[cisco:Cisco-AVPair] = "shell:priv-lvl=15".
  • By default. the daemon accepts tacacs, tacacss, radius and radsec as supported protocols. You can limit this on a per-realm basis. Example: aaa.procotol.allowed = tacacss,radsec. Also, in script conditions comparing aaa.procotol to the pre-defined values works as expected, so you can clearly separate the protocol parts. Example: if (aaa.protocol == tacacs || aaa.protocol == tacacss) { ... }.
  • tactrace.pl now supports RADIUS, too. Use the --radius option to trace RADIUS processing.

Please note that all of this is still work in progress.

Clone this wiki locally