A YANG Data Model for Terminal Access Controller Access-Control System Plus (TACACS+)
obsoletes
- rfc-9105 — A YANG Data Model for Terminal Access Controller Access-Control System Plus (TACACS+)
Extracted elements (29)
The 'domain-name' leaf is distinct from 'address' (the IP/hostname for transport): it provides the TLS SNI server name per RFC 9887 Section 3.4.2, allowing the SNI domain to differ from the connection endpoint.
The obfuscation (shared-secret) security case is retained in the model to accommodate installed base, but is explicitly deprecated in favor of TLS; the description clarifies that obfuscation provides no meaningful integrity, privacy, or replay protection.
The 'port' leaf has no default value (unlike RFC 9105 which defaulted to 49) because TACACS+ over TLS uses port 300, making a single default inappropriate; operators must explicitly configure the port.
This document obsoletes RFC 9105 and is not backward compatible with it; the primary incompatibility is the removal of the default port value and the addition of TLS support as a mandatory security choice option.
If 'source-interface' is configured, the VRF instance value MUST match the network instance bound to the source interface via 'bind-ni-name'.
Implementations MUST support the ability to configure the server's domain name so that it may be included in the TLS Server Name Indication (SNI) extension.
Minimum TLS 1.3 MUST be used for transport when using TACACS+ over TLS. Earlier TLS versions MUST NOT be used.
TACACS+ server administrators SHOULD configure a shared secret with a minimum length of 16 characters; it is highly recommended to be at least 32 characters long with a mix of character types.
The cipher suites offered or accepted SHOULD be configurable via the 'hello-params' data node.
The server list must be unique per address/port number combination, enforced by the 'unique' statement on the server list.
The 'sni-enabled' leaf can only be configured if a 'domain-name' is also provided, enforced via a YANG 'must' constraint.
The TLS hello-params grouping enforces that TLS 1.2 MUST NOT be configured as the minimum or maximum TLS version via 'must' constraints with error-messages.
When 'tacacs-plus' is used as a system authentication method, a TACACS+ authentication server MUST be configured (enforced via a 'must' constraint in the YANG module).
The 'client-credentials' and 'server-credentials' lists (feature 'credential-reference') allow globally provisioned credentials to be referenced by name from specific server instances, avoiding duplication.
The 'client-identity' container supports three auth-type choices: certificate, raw-public-key (feature-gated), and tls13-epsk (feature-gated), each referencing or inlining key material from the keystore.
The 'ietf-system-tacacs-plus' module augments '/sys:system' with a 'tacacs-plus' container that holds 'client-credentials', 'server-credentials', and a 'server' list for AAA configuration.
The 'port' leaf under 'server' is mandatory with no default; the default port for legacy TACACS+ is 49 and for TACACS+ over TLS is 300.
The 'security' choice under each server entry is mandatory and selects either 'tls' (using TLS 1.3) or 'obfuscation' (using a shared secret). The obfuscation case is deprecated in favor of TLS.
The 'server-authentication' container specifies how TLS clients authenticate servers, supporting CA certificates ('ca-certs'), end-entity certificates ('ee-certs'), raw public keys (feature-gated), and EPSKs (feature-gated).
The 'single-connection' boolean leaf (default false) controls whether Single Connection Mode is enabled; in single-connection mode, multiple TACACS+ sessions may share a single TCP connection.
The 'statistics' container under each server entry provides read-only counters including connection-opens, connection-closes, connection-aborts, connection-failures, connection-timeouts, messages-sent, messages-received, errors-received, sessions, cert-errors, and rpk-errors.
The 'tacacs-plus-server-type' typedef uses a bits type with values 'authentication', 'authorization', and 'accounting', allowing any combination for a server entry.
The 'tls13-epsk' grouping defines an External Pre-Shared Key tuple with fields: inline-or-keystore (key material), 'external-identity' (mandatory string label), 'hash' (default sha-256), 'context', 'target-protocol', and 'target-kdf'.
IANA registered the URI 'urn:ietf:params:xml:ns:yang:ietf-system-tacacs-plus' in the 'ns' registry within the IETF XML Registry (RFC 3688).
IANA registered the YANG module 'ietf-system-tacacs-plus' (prefix: sys-tcs-plus) in the 'YANG Module Names' registry within the 'YANG Parameters' registry group, referencing RFC 9950.
The 'client-identity' and 'server-authentication' nodes are restricted with 'nacm:default-deny-write' because any modification to a key or key reference may dramatically alter the implemented security policy.
The 'server' list is sensitive because unauthorized write access could let an attacker redirect the device to a compromised TACACS+ server or manipulate counters to hide attacks; NACM protection is required.
The 'shared-secret' leaf is restricted with 'nacm:default-deny-all' because unauthorized access could make the device vulnerable; the secret should be at least 32 characters with mixed character types.
YANG-based management protocols accessing this module (NETCONF, RESTCONF) must use a secure transport layer (SSH, TLS, QUIC) with mutual authentication.