RADIUS and TACACS+

Overview

RADIUS (Remote Authentication Dial-In User Service) and TACACS+ (Terminal Access Controller Access-Control System Plus) are network protocols used to provide centralized authentication, authorization, and accounting (AAA) services. They are foundational for managing access control in diverse environments such as enterprise networks, cloud platforms, and industrial systems, ensuring secure user identity verification and policy enforcement.

Core Components

• Client devices requesting access (e.g., network access servers, VPN gateways, switches)
• Authentication servers running RADIUS or TACACS+ services
• AAA databases or identity stores containing user credentials and policies
• Communication protocols defining message formats and exchanges
• Accounting subsystems for logging access and usage data

How It Works

Clients initiate access requests which are forwarded to the AAA server using RADIUS or TACACS+ protocols. The server authenticates the user based on credentials and authorizes access according to configured policies. RADIUS typically combines authentication and authorization in a single process, while TACACS+ separates these functions. Both protocols maintain control boundaries between client devices and centralized servers, with communication secured to varying degrees depending on configuration.

Trust & Security Model

• Authentication relies on shared secrets and credential verification methods such as passwords, tokens, or certificates
• Authorization is enforced through policy rules defined on the AAA server
• Trust is established between clients and servers via pre-shared keys or certificates; the security of this trust boundary is critical
• RADIUS encrypts only the user password in transit, whereas TACACS+ encrypts the entire payload, providing stronger confidentiality
• Identity information is centrally managed to enable consistent access control across multiple devices and domains

Common Misconfigurations & Weaknesses

• Use of weak or default shared secrets between clients and servers
• Insufficient encryption or reliance on legacy RADIUS implementations lacking full payload confidentiality
• Improper separation of authentication and authorization leading to policy enforcement gaps
• Failure to restrict access to AAA servers or to segment management traffic
• Inadequate logging or monitoring of AAA events, reducing visibility into access anomalies

Attack Surface & Abuse Scenarios

• Interception or replay of authentication messages due to weak encryption or network exposure
• Credential theft or brute force attacks against AAA servers
• Exploitation of misconfigured authorization policies to gain elevated privileges
• Denial of service targeting AAA infrastructure to disrupt access control
• Cross-protocol risks where RADIUS and TACACS+ coexist without consistent policy enforcement

Visibility & Monitoring

• AAA servers generate logs for authentication attempts, authorization decisions, and accounting records
• Monitoring challenges include correlating events across distributed clients and detecting subtle policy violations
• Telemetry may be limited by protocol design, requiring supplementary network and endpoint monitoring
• Operational observability depends on centralized log aggregation and alerting systems

Hardening & Security Controls

• Use strong, unique shared secrets and rotate them regularly
• Prefer TACACS+ over RADIUS where full payload encryption is required
• Segment AAA traffic on dedicated management networks or VPNs
• Implement multi-factor authentication integrated with AAA servers
• Enforce strict authorization policies and regularly audit access controls
• Deploy comprehensive logging and real-time monitoring with alerting on suspicious activities

Operational Considerations

• Manage lifecycle of credentials and policies through controlled onboarding, modification, and decommissioning processes
• Ensure high availability of AAA servers through redundancy and failover mechanisms to maintain access continuity
• Plan for scalability to accommodate growing numbers of clients and authentication requests
• Maintain dependency management for integration with identity stores and network infrastructure

Related Domains & Dependencies

• Identity and access management (IAM) systems providing user directories and credential stores
• Network infrastructure components such as switches, routers, VPN concentrators, and firewalls
• Cloud and SaaS platforms that integrate AAA protocols for secure access
• Security information and event management (SIEM) systems consuming AAA logs for analysis
• Standards-based protocols like EAP (Extensible Authentication Protocol) used in conjunction with RADIUS

Standards & References

• RFC 2865: Remote Authentication Dial In User Service (RADIUS)
• RFC 2866: RADIUS Accounting
• RFC 1492: TACACS protocol specification
• RFC 8907: TACACS+ Protocol Specification
• Industry best practices for AAA deployment and secure network access