TACACS+ Configuration

While TACACS+ support is not yet implemented in the web console, it is still possible to use your MetaDefender NAC Edge VM as a TACACS server via direct CLI configuration. Instructions on how to do this are provided below.

Get to the bash shell

First you will need SSH access to the NAC Edge VM. Instead of logging in as the admin user (which would bring up the initial setup TUI], you will need to log in as the nac user. If you don't have the password for this user, please contact OPSWAT support.

Create the "tac_plus-ng.cfg" config file

For this guide we'll add a Docker container to the NAC Edge VM which will run a "tac_plus-ng" docker container alongside the docker containers that ship with the VM image.

The first step is to create a "tac_plus-ng.cfg" file with settings appropriate for your environment:

Paste in the following contents. (Be sure to edit the LDAP settings on lines 40-45 and key value on line 69 as appropriate for your environment.)

›

›

›

#!/usr/local/sbin/tac_plus-ng

id = spawnd {…

}

id = tac_plus-ng {…

This example configuration

• Authenticates users against an LDAP Server at 192.168.99.101

• Defines the profiles

  • admins where users have privilege level 15

  • operators where users have privilege level 1

• Defines mappings

  • AD Group NetworkAdmins -> profile admins

  • AD Group NetworkOperator -> profile operators

Start the container

Edit ~/docker-compose.yml

Add the following service definition to the end of the file. (Keep indentation)

Save the file and run the following command to bring up the new container/service

Configure the networking device for AAA for CLI users

The specific commands may vary by the specific model and firmware version of your networking device. Below is for a Cisco switch running IOS 15+