NSS_TACPLUS(8)

📦 version 15.1, in freebsd 14.5, freebsd 15.1

✨ NSS_TACPLUS 💅

okay so bestie, welcome to NSS_TACPLUS(8) — a page from the System Manager's Manual and honestly? it's giving "small but mighty" 🎀

🌸 NAME 🌸

nss_tacplus — the TACACS+ nsswitch module, aka the little module that lets your system ask a TACACS+ server "hey does this person exist" 🦋

⭐ SYNOPSIS ⭐

passwd: files tacplus

that's it. that's the whole slay. put it in your nsswitch.conf and the module is in the mix 🔥

💜 DESCRIPTION 💜

so the nss_tacplus module is a loadable NSS module — like, it plugs into NSS and does its thing — and it provides a minimal identity service backed by a TACACS+ backend. minimal is the key word here, we'll get to that 🙈

and here's the thing, bestie: because the TACACS+ protocol has limits (not its fault, it's just built like that), what nss_tacplus can do is very limited. specifically:

  • it can look up a user by name 🔍
  • it cannot look up a user by uid 😭
  • it cannot enumerate users (no scrolling through the whole list, sorry) 💀

🧚 how the lookup actually goes down

to look up a user, nss_tacplus sends an authorization request with these exact vibes:

  • authentication method: TAC_PLUS_AUTHEN_METH_NOT_SET
  • authentication type: TAC_PLUS_AUTHEN_TYPE_NOT_SET
  • authentication service: TAC_PLUS_AUTHEN_SVC_LOGIN
  • for the "shell" service

then, if the response status is either TAC_PLUS_AUTHOR_STATUS_PASS_ADD or TAC_PLUS_AUTHOR_STATUS_PASS_REPL, the user is considered to exist ✨ and the module fills out a struct passwd for them. periodt. 👑

🍓 the attributes it uses

the following attributes, if they're included in the response from the TACACS+ server, are used to construct the response:

  • UID — the numeric user ID. must be between 0 and UID_MAX. defaults to 65534.
  • GID — the numeric primary group ID. must be between 0 and GID_MAX. defaults to 65534.
  • CLASS — the login class. left blank if it's not provided.
  • GECOS — the display name. if it's not provided, the user name is used instead.
  • HOME — the home directory. defaults to /.
  • SHELL — the shell. defaults to /bin/sh.
💅 okay important detail: case is ignored when matching attribute names — uid, UID, Uid, whatever, all the same. and if an attribute shows up multiple times? the last value takes effect. no cap.

🌈 SEE ALSO 🌈

👑 HISTORY 👑

the nss_tacplus module and this very manual page were written by Dag-Erling Smørgrav <des@FreeBSD.org> for Klara Systems. iconic, honestly 🫶

and that's the whole page, bestie — Debian, June 13, 2023, NSS_TACPLUS(8), that's a wrap 💖✨🎀

📦 where this page comes from