tacon — TACACS+ Client CLI

tacon is a command-line TACACS+ client for sending authentication, authorization, and accounting (AAA) requests to TACACS+ servers.

Connection Modes

tacon supports two connection modes, selected by which endpoint flag you provide:

Direct Mode (--server-addr)

Connects directly to a TACACS+ server. You manage encryption, TLS, and connection settings yourself.

tacon -s tacacs-server:49 -k shared_secret \
    --user admin --port tty0 --rem-addr 10.0.0.1 \
    accounting "show version"

Best for: testing, one-off requests, development, scripts.

Service Mode (--service-endpoint)

Connects to the central tacacsrs-agentd service, which maintains persistent upstream connections with automatic failover.

tacon --service-endpoint /run/tacacs/tacacs.sock \
    --user admin --port tty0 --rem-addr 10.0.0.1 \
    accounting "show version"

Best for: production deployments where multiple clients share TACACS+ connections with automatic failover.

Global Options

Transport Target (one required)

Encryption (direct mode only)

Connection Behaviour (direct mode only)

Debugging

Commands

accounting

Record command execution to a TACACS+ server.

tacon -s server:49 \
    --user admin --port tty0 --rem-addr 10.0.0.1 \
    accounting "show running-config" arg1 arg2

authentication

Authenticate a user against the TACACS+ server. (Not yet implemented.)

authorization

Check whether a user is authorized to execute a command. (Not yet implemented.)

batch

Execute multiple requests from a JSON file.

tacon -s server:49 -k secret batch requests.json

Batch File Format

Batch files are JSON documents containing metadata and a list of requests.

Minimal Example

{
  "requests": [
    {
      "type": "accounting",
      "user": "admin",
      "port": "tty0",
      "rem_addr": "10.0.0.1",
      "cmd": "show version"
    }
  ]
}

Full Example

{
  "metadata": {
    "description": "Nightly accounting audit",
    "parallel": true,
    "load_test": {
      "repetitions": 100,
      "max_parallel": 10
    }
  },
  "requests": [
    {
      "type": "accounting",
      "user": "admin",
      "port": "tty0",
      "rem_addr": "10.0.0.1",
      "cmd": "show running-config",
      "cmd_args": ["brief"]
    }
  ]
}

Metadata Fields

Execution Modes

Batch with Different Connection Modes

# Direct — multiplexed sessions on one connection
tacon -s server:49 -k secret batch requests.json

# Dedicated — one TCP/TLS connection per request
tacon -s server:49 -k secret --dedicated batch requests.json

# Service — routed through the agent with failover
tacon --service-endpoint /run/tacacs/tacacs.sock batch requests.json

Transport Options

Legacy TACACS+ (obfuscation only)

tacon -s tacacs-server:49 -k tac_plus_key \
    --user admin --port tty0 --rem-addr 10.0.0.1 \
    accounting "show version"

YANG JSON configuration

tacon --config ./tacacs.json \
    --user admin --port tty0 --rem-addr 10.0.0.1 \
    accounting "show version"

The config file must use RFC 7951 JSON encoding with the root key ietf-system-tacacs-plus:tacacs-plus.

TLS 1.3 with Certificates

tacon -s tacacs-server:449 --use-tls \
    --client-certificate client.crt.der --client-key client.key.der \
    --user admin --port tty0 --rem-addr 10.0.0.1 \
    accounting "show version"

TLS 1.3 with Pre-Shared Keys

(Requires the psk feature.)

tacon -s tacacs-server:449 --use-tls \
    --psk-identity client1 --psk-key "shared_secret_at_least_16_bytes" \
    --user admin --port tty0 --rem-addr 10.0.0.1 \
    accounting "show version"

Exit Codes