The Advantages of TACACS+ for
Administrator Authentication
Centrally manage and secure your network devices with one easy to deploy solution.
IT departments are responsible for managing many routers, switches, firewalls, and access points
throughout a network. They need to be able to implement policies to determine who can log in to manage
each device, what operations they can run, and log all actions taken. Managing these policies separately on
each device can become unmanageable and lead to security incidents or errors that result in loss of service
and network downtime. Most compliance requirements and security standards require using standardized
tools to centralize authentication for administrative management. Some vendors offer proprietary
management systems, but those only work on that vendor's devices, and can be very expensive. Many IT
departments choose to use AAA (Authentication, Authorization and Accounting) protocols RADIUS or
TACACS+ to address these issues. These protocols enable you to have all network devices managed by a
single platform, and the protocols are already built in to most devices.
For more information, visit www.tacacs.net. | © 2011 TACACS.net 1
Protocol Differences
RADIUS was designed to authenticate and log dial-up remote
users to a network, and TACACS+ is used most commonly for
administrator access to network devices like routers and
switches. This is indicated in the names of the protocols. RADIUS
stands for Remote Access Dial-In User Service, and TACACS+
stands for Terminal Access Controller Access Control Service
Plus.
The primary functional difference between RADIUS and
TACACS+ is that TACACS+ separates out the Authorization
functionality, where RADIUS combines both Authentication and
Authorization. Though this may seem like a small detail, it makes
a world of difference when implementing administrator AAA in a
network environment.
RADIUS can include privilege information in the authentication reply; however, it can only provide the privilege level, which means different things to different vendors. Because there is no standard between vendor implementations of RADIUS authorization, each vendor’s attributes often conflict, resulting in inconsistent results. Even if this information were consistent, the administrator would still need to manage the privilege level for commands on each device. This will quickly become unmanageable. RADIUS doesn’t log the commands used by the administrator. It will only log the start, stop, and interim records of that session. This means that if there are two or more administrators logged at any one time, there is no way to tell from the RADIUS logs which administrator entered which commands.
RADIUS was designed for subscriber AAA, and TACACS+ is designed for administrator AAA. RADIUS can still be used for small network administrator AAA, but only if authorization is not required, or if it is a homogeneous network (all one vendor). In any scenario where there is a heterogeneous environment or authorization policies are required for network devices, TACACS+ is the best option.
Summary
RADIUS can include privilege information in the authentication reply; however, it can only provide the privilege level, which means different things to different vendors. Because there is no standard between vendor implementations of RADIUS authorization, each vendor’s attributes often conflict, resulting in inconsistent results. Even if this information were consistent, the administrator would still need to manage the privilege level for commands on each device. This will quickly become unmanageable. RADIUS doesn’t log the commands used by the administrator. It will only log the start, stop, and interim records of that session. This means that if there are two or more administrators logged at any one time, there is no way to tell from the RADIUS logs which administrator entered which commands.
RADIUS was designed for subscriber AAA, and TACACS+ is designed for administrator AAA. RADIUS can still be used for small network administrator AAA, but only if authorization is not required, or if it is a homogeneous network (all one vendor). In any scenario where there is a heterogeneous environment or authorization policies are required for network devices, TACACS+ is the best option.
Summary
- RADIUS is designed for subscriber AAA,
- TACACS+ is designed for administrator AAA.
- TACACS+ includes per-command authorization and logging.
- TACACS+ enables you to set access policies by user, device, location, or time of day.
- The TACACS+ protocol is supported by most enterprise and carrier-grade devices.
- TACACS+ and RADIUS services should not be installed on the same server because it can reduce security and increase complexity and licensing costs.
- TACACS+ should be deployed in a fully-trusted, internal network to increase security and simplify management.
- TACACS+ should be installed as close to the user database as possible, preferably on the same server to minimize points of failure and increase performance.
Reference : https://tacas.net and https://freeradius.org
