---
name: "Authen::TacacsPlus"
section: "3pm"
platform: "linux"
package: "libauthen-tacacsplus-perl"
version: "0.28-2+b3"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/Authen::TacacsPlus"
---

# Authen::TacacsPlus(3pm)

Perl extension for authentication using tacacs+ server

## NAME

Authen::TacacsPlus - Perl extension for authentication using tacacs+ server

## SYNOPSIS

```
  use Authen::TacacsPlus;
  $tac = new Authen::TacacsPlus(Host=>$server,
                        Key=>$key,
                        Port=>'tacacs',
                        Timeout=>15);
  or
  $tac = new Authen::TacacsPlus(
     [ Host=>$server1, Key=>$key1, Port=>'tacacs', Timeout=>15 ],
     [ Host=>$server2, Key=>$key2, Port=>'tacacs', Timeout=>15 ],
     [ Host=>$server3, Key=>$key3, Port=>'tacacs', Timeout=>15 ],
     ...  );
  $tac->authen($username,$passwords);
  Authen::TacacsPlus::errmsg();
  $tac->close();
```

## DESCRIPTION

Authen::TacacsPlus allows you to authenticate using tacacs+ server.

```
  $tac = new Authen::TacacsPlus(Host=>$server,
                        Key=>$key,
                        Port=>'tacacs',
                        Timeout=>15);
```

Opens new session with tacacs+ server on host `$server`, encrypted with key `$key`. Undefined object is returned if something wrong (check **errmsg()**).

With a list of servers the order is relevant. It checks the availability of the Tacacs+ service using the order you defined.

```
  Authen::TacacsPlus::errmsg();
```

Returns last error message.

```
  $tac->authen($username,$password,$authen_type);
```

Tries an authentication with `$username` and `$password`. 1 is returned if authenticaton succeded and 0 if failed (check **errmsg()** for reason).

`$authen_type` is an optional argument that specifies what type of authentication to perform. Allowable options are: Authen::TacacsPlus::TAC\_PLUS\_AUTHEN\_TYPE\_ASCII (default) Authen::TacacsPlus::TAC\_PLUS\_AUTHEN\_TYPE\_PAP Authen::TacacsPlus::TAC\_PLUS\_AUTHEN\_TYPE\_CHAP

ASCII uses Tacacs+ version 0, and will authenticate against  the "login" or "global" password on the Tacacs+ server. If no authen\_type is specified, it defaults to this type of authentication.

PAP uses Tacacs+ version 1, and will authenticate against  the "pap" or "global" password on the Tacacs+ server.

CHAP uses Tacacs+ version 1, and will authenticate against  the "chap" or "global" password on the Tacacs+ server. With CHAP, the password if formed by the concatenation of\
   chap id + chap challenge + chap response

There is example code in test.pl

If you use a list of servers you can continue using `$tac`-\>authen if one of them goes down or become unreachable.

```
  $tac->close();
```

Closes session with tacacs+ server.

## EXAMPLE

```
  use Authen::TacacsPlus;

  $tac = new Authen::TacacsPlus(Host=>'foo.bar.ru',Key=>'9999');
  unless ($tac){
          print "Error: ",Authen::TacacsPlus::errmsg(),"\n";
          exit(1);
  }
  if ($tac->authen('john','johnpass')){
          print "Granted\n";
  } else {
          print "Denied: ",Authen::TacacsPlus::errmsg(),"\n";
  }
  $tac->close();
```

## AUTHOR

Mike Shoyher, msh@corbina.net, msh@apache.lexa.ru

Mike McCauley, mikem@airspayce.com

## BUGS

only authentication is supported

only one session may be active (you have to close one session before opening another one)

## SEE ALSO

[**perl**(1)](/perl/1.md).