tacacs_plus

What it is and what it does

tacacs_plus is a TACACS+ client for Python that implements the full AAA (authentication, authorization, accounting) protocol. It provides both a programmatic API via the TACACSClient class and a command-line tool (tacacs_client) for interacting with TACACS+ servers. The library supports three authentication methods—ASCII, PAP, and CHAP—and can authorize commands and log accounting events to a TACACS+ server.

The package has no external runtime dependencies and installs as a pure Python wheel. However, it is no longer maintained: the repository was archived in 2023 after its last release in August 2018. The description explicitly warns that TACACS+ packet encryption, designed decades ago, is not cryptographically secure and should not be used over untrusted networks. It is suitable only for legacy network infrastructure already committed to TACACS+ and operating in controlled environments.

Use it for:

• Authenticate network device administrators against a centralized TACACS+ server in legacy enterprise environments.
• Authorize shell commands or Junos-exec operations on network devices via TACACS+ AV pairs.
• Log accounting events (start, stop, watchdog) for command execution on network devices to a TACACS+ server.
• Integrate TACACS+ authentication into Python-based network management or automation tools.
• Query a TACACS+ server from a custom CLI tool or script for user credential validation.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

A TACACS+ client library and command-line tool for authentication, authorization, and accounting (AAA) against TACACS+ servers, supporting ASCII, PAP, and CHAP authentication methods.

No, unless you are maintaining legacy code already integrated with TACACS+. The package is abandoned (last release August 2018, no commits since 2023-08-30), has no runtime dependencies but also no active support, and the protocol itself has known cryptographic weaknesses. For existing TACACS+ deployments, use only if already in production and evaluate the security implications of the weak encryption.

Install

tacacs-plus on PyPI

pip install tacacs-plus

uv add tacacs-plus

poetry add tacacs-plus

Installing tacacs_plus

Before you install

Low install friction with no runtime dependencies. However, the package is archived and abandoned as of 2023-08-30, with no maintenance activity since its last release in August 2018. Use only in legacy environments where TACACS+ integration is already established.

License in practice

Licensed under BSD (permissive), allowing use, modification, and distribution with minimal restrictions. No licensing concerns for most deployment scenarios.

Quickstart

pip install tacacs_plus

from tacacs_plus.client import TACACSClient
import socket

cli = TACACSClient('host', 49, 'secret', timeout=10, family=socket.AF_INET)
authen = cli.authenticate('username', 'password')
print("PASS!" if authen.valid else "FAIL!")

Requires a reachable TACACS+ server (typically port 49) and a pre-shared encryption key for communication.

Verify before relying

• Current compatibility with modern Python versions beyond 3.6 (classifiers list 3.4–3.6 only).
• Whether the weak encryption noted in the description affects deployments on untrusted networks.
• Compatibility with recent versions of tac_plus or other TACACS+ server implementations.

Package facts

Evidence: tacacs_plus-2.6-py2.py3-none-any.whl

Keywords: tacas, tacacs+, tacacs_plus, auth, authentication, pap, chap

Tags

More Networking packages