What’s New for Operators

The changes in each tacctl release that people on shift will notice · Checked against tacctl 0.2.22

Printable PDF

Release notes describe every change in depth. This page lists only what changes day-to-day work: renamed commands, new commands and changed behavior. Each release links to its full notes. The newest release comes first.

Scripts break on renames. tacctl does not keep aliases for renamed commands. Check your scripts against every release you skip.

1. tacctl 0.2.22

Not released yet. The release notes follow with the release.

Renamed commands, no aliases. The old forms are now unknown sub-commands, and the one-letter form of --yes is refused:

Up to 0.2.21 From 0.2.22
config listen ... server listen ...
config metrics ... server metrics ...
The one-letter form of --yes, on any command --yes
device list (and --json) with the enrolled hosts host list (and --json) for the hosts; device list has devices only
Change What it means on shift Page
host list Shows state, last seen, by and open notices as device list does, with the filters --name, --ip, --scope and --stale Linux Host Operations §1
device list --differs The devices whose last pull differs from what is rendered now, with no login (operator tier) Superuser Daily Operations §4.1
tacctl server server show is this server at a glance (address, name, default method, metrics exporter, backends and listeners); server name sets the name the console shows; server listen and server metrics are the old config listen and config metrics Superuser Daily Operations §11.3
Timing scale For a device behind a long round trip or with a slow CPU, one whole number from 1 to 10 multiplies the host-key scan, session, SNMP and per-device pull times: device timeout-scale <name>, scope timeout-scale <scope>, config devices timeout-scale (superuser); engineers read it in device show and scope show. 1, the default, changes nothing Connecting to Devices §7, Superuser Daily Operations §4.9
--timing device config pull, diff --pull, plan --pull and apply print, per device, the time of each phase and name the slowest device; timings in --json Engineer Guide §3
host sync and host check take --concurrency <n> Several hosts at once, output in the order typed; nothing is asked, so a key or agent and a root or passwordless-sudo login are needed Linux Host Operations §2.1
Unknown sub-command One error line, a Did you mean hint and a pointer to -h; below the first word it is answered before sudo asks for a password Getting Started §5
User names A period is refused again; a user stored with one stays readable and is renamed with user rename Access Lifecycle §2
Host keys of slow devices A device ssh-keyscan reads nothing from is read by tacctl’s own ssh client Connecting to Devices §6
Junos virtual chassis The master answers without a label, and the apply reads it Engineer Guide §5.1
Teal command names The console’s lists show command names in teal like the other fixed words Superuser Daily Operations §10.2
Generated tacquito drop-in Its comment, and the shipped unit comments, name server listen and server metrics; the first render restarts tacquito once (see below) Backups and Undo §5
tacctl rollback 0.2.21 The release before this one is a target; it removes server.name and the timing scale and converts nothing else Backups and Undo §5

Before upgrading from 0.2.21:

  • Rename every user whose name has a period (tacctl user list shows them; tacctl user rename <name> <new-name>). If one is left, 0.2.20 or 0.2.21 has already replaced tacctl and the tacquito build when the new tacctl refuses; the store, the configuration and the services are not changed, and tacctl upgrade run again after the rename finishes it.
  • Change scripts, runbooks and notes: config listen and config metrics become server listen and server metrics, the one-letter form of --yes is spelled out, and a script that reads hosts from device list reads host list.
  • No sudoers rule and no stored setting needs to change: the server family is the superuser’s, as config listen and config metrics were, and writes the same keys. The timing scale needs no conversion either: it is 1 until a superuser sets it, and every timing is as before.
  • Expect one brief interruption of TACACS+. The comment at the top of the generated tacquito drop-in names the current commands, so the first render after the upgrade (the upgrade’s own, else the first config render or change of a listener, loglevel or exporter) rewrites the drop-in, reloads systemd and restarts tacquito once. The upgrade restarts tacquito once at its end for any changed unit file or drop-in, and that is this restart. RADIUS is not touched. A drop-in you edited by hand is saved aside before it is replaced.
  • The way back is tacctl rollback 0.2.21. It removes server.name and the timing scale (the two tacctl.yaml keys and each device’s timeout_scale), with a note in the plan and no --yes. After it the older release’s config validate reports the rendered config as out of date until its first render writes its own comment, which restarts tacquito once; the rollback itself restarts nothing.

2. tacctl 0.2.21

Released 2026-10-28 · Full release notes

Change What it means on shift Page
Every user logs in to the server Every user can log in to the tacctl server and its console, whatever their scopes, unless disabled or in a group of tier none. The login is a scope called tacctl that tacctl manages: reserved, in no listing, edited by no command. Device logins keep the user’s own scopes. Superuser Daily Operations §10, §11.1
install and upgrade set the login up install asks once (--yes answers, --server <ip> sets the address); upgrade asks on a terminal only. host enroll --local stays the way to rebuild, move or repair it. Superuser Daily Operations §11.1
tacctl server addresses The address devices and hosts reach the server at is a setting of its own. The device walkthroughs, config linux script and host enroll default to it. Superuser Daily Operations §11.2
ssh asks for the password first With the password cache on and empty, ssh and device ssh ask for the password once, before they connect; the next ssh asks nothing. Getting Started §1.3
Walkthroughs follow the listener port A TACACS+ listener that is not on 49 adds its port to the Cisco and Junos walkthroughs and the WTI Authentication Port item. Engineer Guide §4.1
Junos chassis of one member device config apply treats it like a single device Engineer Guide §5.1
tacctl rollback 0.2.20 The release before this one is a target; every target keeps the users’ server login Backups and Undo §5

Before the upgrade, rename a scope of your own that is called tacctl (tacctl scope rename tacctl <new-name>): it is never taken over, and while it exists host enroll --local, the sync of the server and config validate stop with one line. After it, check the line about the machine’s own login, and run tacctl host sync <server> as before.

3. tacctl 0.2.20

Released 2026-10-28 · Full release notes

Removed console commands, no aliases. The old forms are now unknown sub-commands:

Up to 0.2.19 From 0.2.20
console tiers, console user (who gets the console) Nothing to set: the console is the login shell of every tacctl user
console system-shell tiers <csv>|none console system-shell <tier> enable|disable
Change What it means on shift Page
Required password change A new user, and a user whose password a superuser reset, must change it at the next login to the tacctl server before any device accepts them. --no-change-required skips it; user require-password-change sets or lifts it. Getting Started §2.1, Access Lifecycle §5.1
The console for everyone Every tacctl user, of every tier, logs in to the server’s console. The system shell is opened by a superuser per tier or per user; engineers never have it. Superuser Daily Operations §10
Password cache is your choice console password-cache on turns it on for you, where your tier is allowed it; it is off until you do Getting Started §1.3
--help, -h and tacctl man --help after a command prints what ? prints; man <command> opens the manual page there, in the console too. In bash, ? after tacctl … prints help. Getting Started §1
console color, console list-max The console’s list colours and the longest list it shows without asking Superuser Daily Operations §10.2
Strict Junos management filter scope mgmt-acl <scope> mode strict makes the Junos filter deny by default; engineers can read the mode of their scopes Vendor Notes §3.4
Junos root as break-glass scope breakglass <scope> add root; the walkthrough renders the root password and root-login allow as comments to fill in Break Glass §1.1
Kept: and Secrets: in plans A device’s own SNMP, system and NETCONF statements are no irregularity any more; the secrets line is information Engineer Guide §4
Apply on a virtual chassis The check and the commits must answer for every member; PENDING until is the device’s own clock Engineer Guide §5.1
Host keys read one type at a time A device that gives no key to the scan is asked again, and the refusal says how to pin a key by hand Connecting to Devices §6
User names with a period 0.2.20 and 0.2.21 accept a period between the parts of a user name; such a user has no Linux account. 0.2.22 refuses a period Access Lifecycle §2
tacctl rollback 0.2.19 Goes back to the previous release, with warnings for what it undoes Backups and Undo §5

After the upgrade, run tacctl host sync <server> for the server’s own host entry: the console becomes the login shell of every tacctl user then, and not before. No existing user must change their password until a superuser says so.

4. tacctl 0.2.19

Full release notes

Change What it means on shift Page
Emergency lockdown (tacctl emergency lockdown) Superusers can refuse the logins of chosen groups on a scope at once. A red notice appears on every command that names a locked scope. Emergency Lockdown
Engineers work their own scopes Engineers can enroll, collect, onboard, sync and apply for the devices of their own scopes Engineer Guide
tacctl device support-bundle Collects a scrubbed, read-only bundle of what a developer needs from one device Device commands (repo)
Wider system blocks Junos and IOS system blocks now cover syslog, login banners, login retry and password policy, ssh settings and timestamps; plans can remove a service a scope requires to be off Engineer Guide §3
Host names may contain dots tacctl host rename web1 web1.example.net works Linux Host Operations
Unknown commands answered first A mistyped command is answered before sudo asks for a password —

5. tacctl 0.2.18

Full release notes

Renamed commands, no aliases. The old names are now unknown commands:

Up to 0.2.17 From 0.2.18
device config-syntax <name> [auto|ios12|modern] device ios-syntax <name> [auto|ios12|modern]
device add --config-syntax <syntax> device add --ios-syntax <syntax>
device notices [<name>] [--all] device notice list [<name>] [--all]
device ssh-config device client-config

Also: Tab now completes these names with a space, ? describes every command and flag from its own usage, and a mistyped command suggests what you may have meant (tacctl enroll suggests device enroll and host enroll). Every tier can run device notice list and device client-config.

6. tacctl 0.2.17

Full release notes

Change What it means on shift Page
tacctl device enroll One attended command from a new address to its plan: key, vendor, registration, pull, plan Engineer Guide §2.2
Apply review asks per device Approve each Junos device by typing its name. Typing a count no longer works; scripts use --confirmed --yes. Engineer Guide §5.1
Host keys accepted one device at a time enroll, collect and onboard show the one key they will pin; you accept it by typing the name back Connecting to Devices §6
Audit session id Every audit line ends in sid=<id>, so one grep finds a whole command. Log filters that anchor the end of a line ($) need updating. Audit and Compliance §2
cmd start / cmd end lines Every change writes a start and an end line, with the result and the snapshot taken Audit and Compliance
Vendor read by SNMP device add and device check say which vendor the device reports; device vendor <name> --from-device sets it Engineer Guide §2.4
New selectors device config pull, diff, plan and apply take --differs, --name and --ip; apply --pull reads fresh first Engineer Guide §5.1

7. Older releases

Releases 0.2.0 to 0.2.16 are listed on the releases page, and every change is numbered in CHANGELOG.md.

See also: About These Docs (which release each page was checked against) · tacctl version