PAM_TACPLUS(8)

💅 PAM_TACPLUS 💅

okay so bestie, welcome to the pam_tacplus(8) era — yes that's a section 8 situation, we're in System Manager's Manual territory, and honestly? iconic. sit down, grab a matcha, let's get into it 🍓

---

✨ NAME ✨

pam_tacplus — the TACACS+ authentication PAM module, no cap 💖

---

🌸 SYNOPSIS 🌸

[service-name] module-type control-flag pam_tacplus [options]

that's the whole vibe check: you slot it into a PAM config line with a service name, a module type, a control flag, and then whatever options your heart desires 🎀

---

🦋 DESCRIPTION 🦋

so pam_tacplus is the module that brings TACACS+ protocol authentication services to the PAM (Pluggable Authentication Module) framework. it's giving plug-in, it's giving protocol girlie, it's literally doing the most for your login stack 👑

The pam_tacplus module accepts these optional parameters:

• use_first_pass — makes pam_tacplus reuse a password that was already entered earlier instead of prompting for a fresh one. and if no password has been entered at all? authentication fails, periodt. no password, no entry 💀
• try_first_pass — makes pam_tacplus use a previously entered password if one is available. if nothing's been entered, it just prompts for one like usual. lowkey the chill version of use_first_pass 🫶
• echo_pass — causes echoing to be left on if pam_tacplus prompts for a password. yes, on. as in, visible. we're being brave today 🙈
• *conf=pathname* — specifies a non-standard location for the TACACS+ client configuration file (normally located in /etc/tacplus.conf). you're not stuck with the default, you're the main character of your own file path ✨
• *template_user=username* — specifies a user whose passwd(5) entry will be used as a template to create the session environment if the supplied username does not exist in local password database. the user will be authenticated with the supplied username and password, but his credentials to the system will be presented as the ones for username, i.e., his login class, home directory, resource limits, etc. will be set to ones defined for username. basically you log in as yourself but cosplay as username for the environment vibes 🧚

If this option is omitted, and there is no username in the system databases equal to the supplied one (as determined by call to getpwnam(3)), the authentication will fail. no template, no luck. that's the rule 🎀

---

💜 FILES 💜

• /etc/tacplus.conf — The standard TACACS+ client configuration file for pam_tacplus. this is the default spot, the home base, the standard-issue config 🏠

---

🌈 SEE ALSO 🌈

pam(3), passwd(5), tacplus.conf(5), nss_tacplus(8)

go read those too, bestie, they're all part of the lore 📚

---

⭐ HISTORY ⭐

The pam_tacplus module first appeared in FreeBSD 3.1. she's been around. she's a legacy icon 👑

---

🎀 AUTHORS 🎀

The pam_tacplus manual page was written by Andrzej Bialecki <abial@FreeBSD.org> and adapted to TACACS+ from RADIUS by Mark R V Murray <markm@FreeBSD.org>.

The pam_tacplus module was written by John D. Polstra <jdp@FreeBSD.org>.

absolute legends, all three of them, we stan 🫶

---

and that's the page, bestie!! this one's from Debian, dated May 17, 2023 — mwah, slay, go authenticate something responsibly 💅✨🔥