TACACS and XTACACS

Stands for: Terminal Access Controller Access-Control System (RFC 1492) and Cisco's extended TACACS, the ancestors of TACACS+

The original Terminal Access Controller Access-Control System of the ARPANET, documented in RFC 1492, and Cisco's extended XTACACS: the clear-text, port-49 ancestors of TACACS+, which shares their name and almost nothing else.

RFC 1492, An Access Control Protocol, Sometimes Called TACACS, published in July 1993 by Finseth of the University of Minnesota as an Informational document, records a protocol created to control access to dial-up lines on the ARPANET. A terminal server sends a username and password to a server on port 49, by UDP or TCP, and receives accept or reject; the credentials travel in clear text. The RFC notes that "Cisco Systems terminal servers implement an extended version of this TACACS protocol", which is XTACACS, with "more types of authentication requests and more types of response codes" than the original. TACACS+ kept the name and the port and replaced everything else: it is a Cisco design of the 1990s, written down in "The Draft" of 1998 and finally documented by RFC 8907 in September 2020, with three separate conversations for authentication, authorization and accounting and a body obfuscated with the shared key. The three are not interoperable, and the plus sign is the whole difference: a device offering "TACACS" in a 1990s menu meant one of the first two, and anything deployed today means the third.

The name TACACS covers three protocols that share a port and a purpose and nothing else, and the history is short enough to keep straight. The first is the ARPANET's. RFC 1492, An Access Control Protocol, Sometimes Called TACACS, published in July 1993 by Finseth of the University of Minnesota as an Informational document, describes a protocol that was created to control access to dial-up lines on the ARPANET: a terminal server that a user has dialled into sends the username and password to an access control server on port 49, over UDP or TCP, and the server answers accept or reject. The document records the protocol as it was found running rather than as a design, which is why its title hedges, and it is explicit that the credentials travel in clear text.

The second is Cisco's extension. RFC 1492 notes that "Cisco Systems terminal servers implement an extended version of this TACACS protocol", known as XTACACS, with "more types of authentication requests and more types of response codes" than the original: the server could be asked not only whether a user might log in, but about connections and other events, and could answer with more than yes or no. It remained a simple query protocol with the same exposure of credentials, and it is the one that early Cisco documentation and configuration keywords mean by the bare word.

The third is TACACS+, which kept the name and TCP port 49 and replaced the design. RFC 8907 of September 2020, the first document to describe it formally, records that it is based on "The Draft" of 1998, a vendor specification circulated for years without being standardised, and that the plus-sign protocol has three distinct packet types for authentication, authorization and accounting, a 12-byte header and a body obfuscated by XOR with MD5-derived padding of a shared key. None of the three interoperates with the others; a TACACS+ server cannot answer an XTACACS client, and a device configured for one is not configured for the other.

For a reader today the distinction matters in two places. In old documentation and in the memory of engineers who ran terminal servers, TACACS means one of the first two, and the warnings about clear-text passwords attached to it are true of them. In anything deployed now the word means TACACS+, whose own weaknesses are of a different kind, obfuscation rather than encryption and a dependence on a protected management network, and whose strengths, per-command authorisation and command accounting, the first two never had. The TACACS+ entry covers the living protocol.

Also known as: xtacacs, tacacs original, rfc 1492, extended tacacs

Sources

← All glossary entries