---
name: "nss_tacplus"
section: "8"
platform: "freebsd"
package: "base"
version: "16.0-CURRENT-20261027-61c70dc16a79"
release: "FreeBSD 16.0-CURRENT (2026-10-27)"
platforms: ["freebsd"]
url: "https://new.carta.tech/nss_tacplus"
---

# nss\_tacplus(8)

TACACS+ nsswitch module

## NAME

**nss\_tacplus** – TACACS+ nsswitch module

## SYNOPSIS

**passwd**: **files** **tacplus**

## DESCRIPTION

The **nss\_tacplus** module is a loadable NSS module which provides a minimal identity service using a TACACS+ backend.

Due to the limitations of the TACACS+ protocol, the functionality provided by the **nss\_tacplus** module is very limited: it can look up a user by name, but not by uid, and it cannot enumerate users.

To look up a user, the **nss\_tacplus** module submits an authorization request with authentication method TAC\_PLUS\_AUTHEN\_METH\_NOT\_SET, authentication type TAC\_PLUS\_AUTHEN\_TYPE\_NOT\_SET, and authentication service TAC\_PLUS\_AUTHEN\_SVC\_LOGIN, for the “shell” service. If the response status is either TAC\_PLUS\_AUTHOR\_STATUS\_PASS\_ADD or TAC\_PLUS\_AUTHOR\_STATUS\_PASS\_REPL, the user is considered to exist and the **nss\_tacplus** module fills out a *struct* *passwd* for it.

The following attributes, if included in the response from the TACACS+ server, are used to construct the response:

- *UID*

  Numeric user ID. Must be between 0 and UID\_MAX. Defaults to 65534.

- *GID*

  Numeric primary group ID. Must be between 0 and GID\_MAX. Defaults to 65534.

- *CLASS*

  Login class. Left blank if not provided.

- *GECOS*

  Display name. If not provided, the user name is used instead.

- *HOME*

  Home directory. Defaults to */*.

- *SHELL*

  Shell. Defaults to */bin/sh*.

Case is ignored when matching attribute names. If an attribute is included multiple times, the last value takes effect.

## SEE ALSO

[libtacplus(3)](/libtacplus/3.md), [tacplus.conf(5)](/tacplus.conf/5.md), [pam\_tacplus(8)](/pam_tacplus/8.md)

## HISTORY

The **nss\_tacplus** module and this manual page were written by Dag-Erling Smørgrav ⟨*des@FreeBSD.org*⟩ for Klara Systems.