Keycyte PAM 3.2 · Administrator Guide

Configuring the TACACS+ Server

Keycyte PAM includes a TACACS+ server for the administration of network devices such as switches, routers and firewalls. Devices send the sign-in, command authorization and accounting of their administrators to Keycyte PAM, which applies the same users, roles and MFA as for other sessions.

The TACACS+ server runs as a separate Keycyte PAM service. You can see its state and restart it on the Services page.

How Devices Are Registered

A device is registered by entering a TACACS+ Shared Secret in the settings of the server (asset) that represents the device. Each device then uses its own secret. The Fallback Shared Secret on this page is used only by devices that have no secret of their own.

The privilege level that a device grants to the user comes from the TACACS+ Privilege Level of the server roles that cover the user. For details, see Server Roles.

Configuring the TACACS+ Server

To open the page, select Settings > TACACS+ Server. Until you save the page, the server runs on its own default settings.

To configure the server:

1. Specify the following settings:

   Field	Description
   Listen Port	TCP port the server listens on. Default: 49.
   Fallback Shared Secret	Secret for devices that have no secret of their own. Leave it empty so that unregistered devices cannot connect at all.
   Allowed Device IPs	Comma-separated addresses or CIDR ranges of the devices allowed to connect, for example 10.0.0.0/24. Leave it empty to allow all.
   Device Secret Cache (seconds)	How long a device secret is reused before it is looked up again, 0 to 86400. Default: 300. A changed secret takes effect after this time, without a restart.
   PAP MFA Separator	PAP has no second prompt, so users with MFA append the code to the password: password<separator>123456. Default: ,. Enter none to disable; users with MFA then cannot sign in over PAP.
   Log Level	DEBUG, INFO (default) or ERROR.
   Description	Free-text note.

2. To protect the TACACS+ traffic with TLS 1.3, select Enable TLS in the TLS 1.3 section and specify:

   Field	Description
   Certificate File	Path of the server certificate, for example /etc/keycyte/tls/tacacs.crt.
   Private Key File	Path of the private key, for example /etc/keycyte/tls/tacacs.key.
   Require Client Certificate	Accepts only devices that present a client certificate.
   CA File	Path of the CA certificate that signs the client certificates. Required when Require Client Certificate is selected.

   The paths refer to the file system of the TACACS+ server, not to your workstation.

3. Click Save.