Home

The tacctl operations documentation: where to start, by role and by situation · Checked against tacctl 0.2.22

Printable PDF

tacctl keeps the users, groups and scopes of your network-device logins in one place and serves them over TACACS+ (and RADIUS, where enabled) to Cisco IOS/IOS-XE, Juniper Junos, WTI console servers and Linux hosts. This documentation covers using tacctl during a shift: connecting to devices, managing access, changing device AAA configuration, and handling incidents.

Installation, upgrades and server internals are in the repository documentation. Every command and setting is in man tacctl on the server.


1. Where to start

2. Something is happening now

Situation Go to
A user can’t log in, a device won’t connect, a pull fails Troubleshooting
tacctl ssh refuses or warns about a host key Connecting to Devices
Credentials leaked, account compromised, secret exposed Incident Response Runbooks
A group must be locked out of a scope now Emergency Lockdown
A device or host is locked out after a bad change Break Glass
A tacctl change made things worse Backups and Undo

3. All pages


See also: About These Docs for the example names, the release each page was checked against, and how to report a mistake.