Last Updated: Wednesday, 8 June 2022 By: Steve Warner

CISCO ROUTER

aaa new-model
aaa authentication login default tacacs+ enable 
aaa authentication enable default tacacs+ enable
aaa authorization commands 1 default tacacs+ none
aaa authorization commands 15 default tacacs+ none
aaa accounting exec default start-stop tacacs+
aaa accounting commands 1 default start-stop tacacs+
aaa accounting commands 15 default start-stop tacacs+
aaa accounting network default start-stop tacacs+
aaa accounting connection default start-stop tacacs+
aaa accounting system default start-stop tacacs+

tacacs-server host 172.16.0.1
tacacs-server key bdsltd
enable secret spicegirls


For Local Authentication 

aaa authentication login default tacacs+ local
username bill password ben

LINUX

Files Below From
tac_plus-F4.0.3.alpha-5.i386.rpm
tac_plus-F4.0.3.alpha-6.i386.rpm
tac_plus-F4.0.3.alpha-7.i386.rpm
tac_plus-F4.0.3.alpha-7 src

/etc/tacacs/tac_plus.cfg

key = bdsltd

# Use /etc/shadow file to do authentication

default authentication = file /etc/shadow

# Where is the accounting records to go

accounting file = /var/log/tac_acc.log

# Profile for enable access, username is $enab15$. Used to be $enable$

user = $enab15$ {
    login = cleartext "spicegirls"
}

# Profiles for user accounts

user = bill {
    default service = permit
    login = file /etc/shadow
}

user = idiot {
    login = cleartext ohno
    cmd = show {
             permit "interface*"
             permit "ip interface*"
    }
    cmd = ping {
             permit .*
    }
    cmd = traceroute {
             permit .*
    }
}

# Profile for script altering config on router

user = script {
    login = cleartext passwd
    cmd = configure {
             permit "terminal"
    }

    cmd = interface { permit "Dialer 1" }
    cmd = description { permit .* }
    cmd = dialer {
             permit "string"
             permit "load-threshold"
    }

    cmd = ppp {
             permit "pap sent-username"
             permit "multilink"
    }

    cmd = no {
             permit "dialer string"
             permit "dialer load-threshold"
             permit "ppp pap sent-username"
             permit "ppp multilink"
    }

    cmd = write { permit . }
}