TacacsPlus(3pm)

✨ NAME ✨

Authen::TacacsPlus — bestie, it's a Perl extension for authenticating against a tacacs+ server 💖 (this is the TacacsPlus(3pm) page, from the User Contributed Perl Documentation, in case you were wondering which page you opened 🫶)

---

🌸 SYNOPSIS 🌸

Okay so here's the whole vibe at a glance:

use Authen::TacacsPlus;

$tac = new Authen::TacacsPlus(Host=>$server,
                      Key=>$key,
                      Port=>'tacacs',
                      Timeout=>15);

or — and hear me out — the multi-server edition 🎀

$tac = new Authen::TacacsPlus(
   [ Host=>$server1, Key=>$key1, Port=>'tacacs', Timeout=>15 ],
   [ Host=>$server2, Key=>$key2, Port=>'tacacs', Timeout=>15 ],
   [ Host=>$server3, Key=>$key3, Port=>'tacacs', Timeout=>15 ],
   ...  );

then like, actually do the thing:

$tac->authen($username,$passwords);

Authen::TacacsPlus::errmsg();

$tac->close();

---

💅 DESCRIPTION 💅

Authen::TacacsPlus lets you authenticate using a tacacs+ server. That's the whole plot, and honestly? Iconic.

$tac = new Authen::TacacsPlus(Host=>$server,
                      Key=>$key,
                      Port=>'tacacs',
                      Timeout=>15);

This opens a whole new session with the tacacs+ server on host $server, encrypted with key $key. ✨ If something goes wrong you get an undefined object back — so always check errmsg(), bestie, don't just assume it worked 😭.

And if you pass a list of servers, the order is relevant, no cap. It checks the availability of the Tacacs+ service using the order you defined. First one up wins, basically the friend group deciding where to eat except it actually works.

Authen::TacacsPlus::errmsg();

Returns the last error message. Simple. Your little detective tool when things are giving chaos. 🕵️

$tac->authen($username,$password,$authen_type);

Tries an authentication with $username and $password. You get 1 back if authentication succeeded, and 0 if it failed — and if it failed you go check errmsg() for the reason, obviously. 🙈

$authen_type is an optional argument that says what type of authentication to perform. The allowable options are:

• Authen::TacacsPlus::TAC_PLUS_AUTHEN_TYPE_ASCII — this is the default, 💫
• Authen::TacacsPlus::TAC_PLUS_AUTHEN_TYPE_PAP
• Authen::TacacsPlus::TAC_PLUS_AUTHEN_TYPE_CHAP

Now let's break each one down, because they are not the same girl:

• ASCII uses Tacacs+ version 0, and authenticates against the "login" or "global" password on the Tacacs+ server. If you don't specify any authen_type, it defaults to this type of authentication. 🍓
• PAP uses Tacacs+ version 1, and authenticates against the "pap" or "global" password on the Tacacs+ server. 💜
• CHAP uses Tacacs+ version 1, and authenticates against the "chap" or "global" password on the Tacacs+ server. Now listen closely for this part: with CHAP, the password is formed by the concatenation of

chap id + chap challenge + chap response

There's example code in test.pl, so go peek if you want receipts. 👑

And the flex: if you're using a list of servers, you can keep using $tac->authen even when one of them goes down or becomes unreachable. Redundancy? We love her. 🫶

$tac->close();

Closes the session with the tacacs+ server. Clean exit, main character energy. ✨

---

🔥 EXAMPLE 🔥

A whole little program, exactly like the original says:

use Authen::TacacsPlus;

$tac = new Authen::TacacsPlus(Host=>'foo.bar.ru',Key=>'9999');
unless ($tac){
        print "Error: ",Authen::TacacsPlus::errmsg(),"\n";
        exit(1);
}
if ($tac->authen('john','johnpass')){
        print "Granted\n";
} else {
        print "Denied: ",Authen::TacacsPlus::errmsg(),"\n";
}
$tac->close();

Look at that error handling. Look at that close. We stan a responsible dev. 😌

---

🌈 AUTHOR 🌈

• Mike Shoyher, msh@corbina.net, msh@apache.lexa.ru
• Mike McCauley, mikem@airspayce.com

Legends, both of them. 👑

---

💀 BUGS 💀

Okay bestie, warnings time, do not skip this part:

• only authentication is supported
• only one session may be active (you have to close one session before opening another one)

So yeah — one at a time, no juggling. Close before you open. That's the rule. 🎀

---

👀 SEE ALSO 👀

perl(1).

---

Ty for coming to my TED talk, go forth and authenticate responsibly 💖✨

That was TacacsPlus(3pm) — from perl v5.42.3, dated 2026-08-19. Mwah, bye bestie 🦋💜