| Internet-Draft | TACACS+ Security | March 2022 |
| Dahm, et al. | Expires 2 October 2022 | [Page] |
The TACACS+ Protocol [RFC8907] provides device administration for routers, network access servers and other networked computing devices via one or more centralized servers. This document, a companion to the TACACS+ protocol [RFC8907], adds new packet formats to improve security and function, Transport Layer Security (currently defined by TLS 1.3 [RFC8446]) support, and support for SSH [RFC4716] public keys and deprecates former inferior security mechanisms.¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [BCP14] when, and only when, they appear in all capitals, as shown here.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 2 October 2022.¶
Copyright (c) 2022 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
The TACACS+ Protocol [RFC8907] provides device administration for routers, network access servers and other networked computing devices via one or more centralized servers. The protocol provides authentication, authorization and accounting services for TACACS+ clients.¶
While the content of the protocol is highly sensitive, TACACS+ lacks modern and/or effective confidentiality, integrity, and authentication of the connection and network traffic between the server and client. The existing mechanisms of TACACS+ are extremely weak and the Security Considerations section of the TACACS+ Protocol [RFC8907] adequately describes this.¶
To address these deficiencies, this document updates the TACACS+ Protocol [RFC8907] to use TLS 1.3 [RFC8446] authentication and encryption, and deprecates the use of its former mechanisms.¶
To support SSH authentication using public keys, highly desired by the operator community, this document introduces a method to support sending public keys to a TACACS+ client, allowing centralized management.¶
To accomplish these goals and improve security and functionality when a network proxy is involved in a TACACS+ connection, new and uniform packet formats are introduced.¶
The Technical Definitions section of the TACACS+ Protocol [RFC8907] is fully applicable here and will not be repeated, though may be augmented. The following terms are also used in this document.¶
An Attribute-Value Pair or AVP is another name a TACACS+ argument as defined in [RFC8907] Sections 6.1 and 8.¶
An empty or zero-length value of an AVP as defined in [RFC8907] Sections 8.1.¶
This is another term for a Connection as defined in TACACS+ Protocol [RFC8907]. It is a Connection without TLS and therefore being plaintext or possibly using unsecure TACACS+ authentication and obfuscation.¶
This refers to a TACACS+ Server or Client.¶
A TLS Connection is a TCP/IP connection with TLS authentication and encryption used by TACACS+ for transport, similar to a Connection as defined in TACACS+ Protocol [RFC8907].¶
TACACS+ connections are TCP/IP connections initiated by the Client to the Server. The well-known TCP/IP port 49 on the Server is used for unencrypted and encrypted connections as defined in the TACACS+ Protocol [RFC8907]. A connection may be used for only a single Session or the multiplexing of multiple Sessions in TACACS+ Single Connection Mode.¶
TLS is introduced into TACACS+ to fulfill the following requirements:¶
All data exchanged by TACACS+ Peers MUST be encrypted, including the authentication of the Peers. Therefore, TLS Hello MUST be initiated by the client immediately upon the establishment of the TCP/IP connection.¶
This document favors the predictable use of TLS security for a deployment, see (Section 8.2). TACACS+ TLS will therefore follow [RFC7605], where a different well-known system TCP/IP port is assigned by IANA, port [TBD] (Section 9) with the service name [TBDN] (Section 9), for TLS connections.¶
A TACACS+ Client initiates a TLS connection by making a TCP connection to a configured Server on the tacacss well-known port (Section 3.1). Once the TCP connection is established, the Client MUST immediately begin the TLS negotiation before sending any TACACS+ protocol data.¶
Implementations MUST support TLS 1.3 [RFC8446] and MAY permit TLS 1.3 session resumption. If resumption is supported, the resumption ticket_lifetime SHOULD be configurable, including a zero seconds lifetime.¶
Once the TLS connection is established, the exchange of TACACS+ data proceeds as normal, except that it is transmitted over TLS as TLS application data and without TACACS+ obfuscation (see Section 6)¶
The connection persists until the Server or Client closes it. It might be closed due to an error or at the conclusion of the TACACS+ Session. If Single Connection Mode has been negotiated, it might remain open after a successful Session, until an error or a timeout occurs. Why it closed has no bearing on TLS resumption, unless closed by a TLS error, in which case the ticket might be invalidated.¶
Implementations MUST support the TLS 1.3 mandatory cipher suites (See RFC8446 Section 9.1). The cipher suites offered or accepted SHOULD be configurable so that operators can adapt.¶
This document makes no cipher suite recommendations, but recommendations can be found in the TLS Cipher Suites section of the [TLSCSREC].¶
Implementations MUST support certificate-based TLS authentication and certificate revocation bi-directionally for authentication, identity verification and policy purposes. Certificate path verification as described in Section 3.2.2.1 MUST be supported.¶
If this succeeds, the authentication is successful and the connection is permitted. Policy MAY impose further constraints upon the Peer, allowing or denying the connection based on certificate fields or any other parameters exposed by the implementation.¶
Unless disabled by configuration, a Peer MUST disconnect a Peer that offers an invalid TLS Certificate.¶
Implementations MUST support certificate Path verification as described in [RFC5280].¶
In addition to authentication of TLS certificates, implementations MUST support policy consideration of Peer-identifying certificate fields and policy used to verify that the Peer is a valid source for the received certificate and that it is permitted access to TACACS+. Implementations MUST support either:¶
Network location based validation methods as described in [RFC5425], Section 5.2.¶
or¶
Device Identity based validation methods where the peer's identity is used in the certificate subjectName. This is applicable in deployments where the device securely supports an identity which is shared with its peer. This approach allows a peer's network location to be reconfigured without issuing a new client certificate. Only the local server mapping needs to be updated.¶
Versions 1 and 2 of the TACACS+ Protocol, as defined in [RFC8907], specify the TACACS+ Authentication Packets for START, REPLY and CONTINUE which support the credential validation use case but does not accommodate any further arguments which may be used to give context to the request.¶
One use-case where this shortcoming inhibits correct operation is for the TACACS+ proxy. Because the originating client is not encoded in the regular Authentication START Packet, TACACS+ Servers generally attempt to determine the client from the TCP connection. This is effective only for the first step: proxied TACACS+ servers can no longer securely enforce policy based upon the end client IP-Address.¶
Further, advanced use cases (such as SSH key distribution) would otherwise rely on embedding structured information into the single data fields, obfuscating the content of the protocol.¶
To support these use cases, and allow clients to add environment information to the request, the Extended Authentication Packets brings the Authentication phase of the protocol inline with the Authorization and Accounting Phase by incorporating extensible argument s.¶
The server should expect Extended Authentication Packet Bodies if the minor version in the Packet Header is: 0x2¶
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 +----------------+----------------+----------------+----------------+ | action | priv_lvl | authen_type | authen_service | +----------------+----------------+----------------+----------------+ | user_len | port_len | rem_addr_len | data_len | +----------------+----------------+----------------+----------------+ | arg_cnt | +----------------+----------------+----------------+----------------+ | arg_1_len | +----------------+----------------+----------------+----------------+ | ... | +----------------+----------------+----------------+----------------+ | arg_N_len | +----------------+----------------+----------------+----------------+ | user ... +----------------+----------------+----------------+----------------+ | port ... +----------------+----------------+----------------+----------------+ | rem_addr ... +----------------+----------------+----------------+----------------+ | data... +----------------+----------------+----------------+----------------+ | arg_1 ... +----------------+----------------+----------------+----------------+ | arg_2 ... +----------------+----------------+----------------+----------------+ | ... +----------------+----------------+----------------+----------------+ | arg_N ... +----------------+----------------+----------------+----------------+
The action, priv_level, authen_type, authen_service, user_len, port_len, rem_addr_len, data_len, user, port, rem_addr and data fields are used exactly as defined in the Authentication START Packet Body in [RFC8907].¶
The following fields contain the arguments that may be used to extend the authentication process. These are common to the Extended Authentication START, Extended Authentication REPLY, and Extended Authentication CONTINUE packet bodies; these fields represent the sole update from the previous START, REPLY and CONTINUE packet bodies.¶
The new fields are as follows:¶
arg_cnt¶
This represents the number of arguments in the packet.¶
arg_1_len ... arg_N_len, arg_1 ... arg_N¶
Each argument is encoded in the packet as a single arg field (arg_1 ... arg_N) with a corresponding length field that indicates the length of each argument in bytes.¶
The arguments are argument-value pairs. The argument and the value are in a single string and are separated by either a "=" (0X3D) or a "*" (0X2A). The equals sign indicates a mandatory argument. The asterisk indicates an optional one. For the rules regarding optional and mandatory arguments, refer to [RFC8907]¶
Multiple arguments with the same name are permitted within a packet, a common example is cmd-arg. The handling of repeated arguments is specific to the semantics of the argument and so are documented with that argument. Order is significant when processing arguments.¶
The addition of arguments to the authentication packets is intended to permit the flexibility for the TACACS+ authentication phase that has been available previously for authorization and accounting. These fields are intended to be used as needed in deployment, they are used in this document in the enhancements for SSH (Section 5), and to support the origin client to enhance TACACS+ Proxy:¶
origin_client¶
The IP-Address of the originating TACACS+ client. This is text encoded in line with the rest of the TACACS+ protocol, and may be IPv4 or IPv6. This argument is optional. IPv4 addresses are specified as octet numeric values separated by dots ('.'). IPv6 address text representation is defined in [RFC5952].¶
The TACACS+ server sends only one type of extended authentication packet to the client.¶
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 +----------------+----------------+----------------+----------------+ | status | flags | server_msg_len | +----------------+----------------+----------------+----------------+ | data_len | +----------------+----------------+----------------+----------------+ | arg_cnt | +----------------+----------------+----------------+----------------+ | arg_1_len | +----------------+----------------+----------------+----------------+ | ... | +----------------+----------------+----------------+----------------+ | arg_N_len | +----------------+----------------+----------------+----------------+ | data ... +----------------+----------------+----------------+----------------+ | server_msg ... +----------------+----------------+----------------+----------------+ | arg_1 ... +----------------+----------------+----------------+----------------+ | arg_2 ... +----------------+----------------+----------------+----------------+ | ... +----------------+----------------+----------------+----------------+ | arg_N ... +----------------+----------------+----------------+----------------+
The status, flags, server_msg_len, data_len, server_msg, and data fields are used exactly as defined in the Authentication REPLY Packet Body in [RFC8907]].¶
The new arg_cnt, arg_1 ... arg_N, and arg_1_len .... arg_N_len fields are used as defined in The Extended Authentication START Packet Body (Section 4.1).¶
This packet is sent from the client to the server following the receipt of an Extended REPLY packet.¶
1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 1 2 3 4 5 6 7 8 +----------------+----------------+----------------+----------------+ | status | user_msg len | +----------------+----------------+----------------+----------------+ | data_len | +----------------+----------------+----------------+----------------+ | arg_cnt | +----------------+----------------+----------------+----------------+ | arg_1_len | +----------------+----------------+----------------+----------------+ | ... | +----------------+----------------+----------------+----------------+ | arg_N_len | +----------------+----------------+----------------+----------------+ | user_msg ... +----------------+----------------+----------------+----------------+ | data ... +----------------+----------------+----------------+----------------+ | arg_1 ... +----------------+----------------+----------------+----------------+ | arg_2 ... +----------------+----------------+----------------+----------------+ | ... +----------------+----------------+----------------+----------------+ | arg_N ... +----------------+----------------+----------------+----------------+
The user_msg len, data_len, user_msg, and data fields are used exactly as defined in the Authentication REPLY Packet Body in [RFC8907]. However, the status field replaces the flags field and has the following enumeration:¶
TAC_PLUS_AUTHEN_CONTINUE_STATUS_NONE or TAC_PLUS_AUTHEN_CONTINUE_STATUS_ABORT MUST be used when the Extended Authentication Packets are used for the continuation of authentication flows documented in [RFC8907].¶
The client may prematurely terminate a session by setting the TAC_PLUS_AUTHEN_CONTINUE_STATUS_ABORT or TAC_PLUS_AUTHEN_CONTINUE_STATUS_ERROR status in the CONTINUE message. The remainder are detailed in SSH (Section 5).¶
The new arg_cnt, arg_1 ... arg_N, and arg_1_len .... arg_N_len fields are used as defined in The Extended Authentication START Packet Body (Section 4.1).¶
Most network equipment now support SSH [RFC4251] for Command Line Interface (CLI) and NETCONF [RFC6242]. Operators SHOULD use SSH public keys for authentication. Some devices support public keys in native configuration, but there is desire to centrally manage keys and SSH subsystem authorization.¶
The following new enumerated TACACS+ protocol values and well-known AVPs are needed to support SSH in the subsequent sections. These new values augment those in [RFC8907] Sections 5.1 - 5.3, 6.1, and 8.2 as follows:¶
To support central management of SSH public keys via TACACS+, the Authentication sequence of [RFC8907] Section 5.4 is extended using Extended Authentication Packet (Section 4) sequences to deliver SSH public keys to devices for local verification.¶
Besides new header values and flags and AVPs for Extended Authentication Packets, the SSH public key authentication process differs from other TACACS+ authentication types in that there may be more Authentication Reply and Authentication Continue Packets pairs than previously.¶
The process follows:¶
To support central management of SSH and SSH subsystem authorization and accounting via TACACS+, this document adds a new authen_method to RFC8907 Section 6.1 Authorization REQUEST [RFC8907] and a well-known AVP to Section 8.2 Authorization Arguments [RFC8907].¶
The new authen_method TAC_PLUS_AUTHEN_METH_SSHPUBKEY indicates that the user was authenticated with a SSH public key.¶
The well-known ssh_subsystem AVP defines the SSH subsystem for which the authorization is requested and MUST be present any time the authorization is for a SSH connection.¶
The set of permissible values for this AVP are the SSH Subsystem Names defined in the IANA SSH Connection Protocol Subsystem Names Registry [SSHSUBSYS], which are case-sensitive as specified and otherwise constrained by [RFC4250] Section 4.6.1. The client MAY send an Empty Value for the subsystem name to indicate no subsystem, also known as a shell or CLI. The server MUST NOT reply with status TAC_PLUS_AUTHOR_STATUS_ERROR if it receives a subsystem name whose syntax is valid but whose value is not recognized. Subsystems might need additional data for authorization or accounting that will be particular to that subsystem and are therefore out of scope for this document.¶
These new authen_methods and AVPs apply equally to accounting.¶
The original draft of TACACS+ described an encryption mechanism built into the protocol. This is insufficient for modern purposes and the document TACACS+ Protocol [RFC8907] reclassified the mechanism as one capable only of obfuscation.¶
The introduction of TLS PSK and certificate Peer authentication and TLS encryption to TACACS+ obsolesces these former mechanisms and so are hereby deprecated. This section describes how the TACACS+ client and servers MUST operate with regards to the obfuscation mechanism.¶
The TACACS+ server or client receiving TACACS+ Packets MUST process the packet as if TAC_PLUS_UNENCRYPTED_FLAG was set. The actual value of TAC_PLUS_UNENCRYPTED_FLAG flag in the TACACS+ header MUST be ignored.¶
Peers SHOULD set the TAC_PLUS_UNENCRYPTED_FLAG flag in the Packet Header of packets on TLS Connections, indicating that the data obfuscation is not used.¶
This section deprecates features from the TACACS+ Protocol.¶
MS-CHAPv1: has been replaced by MS-CHAPv2 in most deployments, the intent of this deprecation is to complete the transition. MD4 is still required to support MS-CHAPv2 so cannot be deprecated at this point It should be noted that the use of MD4 is purely to allow compatible MS-CHAPv2 operation and not for security; the TLS transport is intended to provide that function.¶
TAC_PLUS_AUTHEN_SENDAUTH: the sendauth mechanism can not be supported, as it permits the leak of sensitive information.¶
This document improves the confidentiality, integrity, and authentication of the connection and network traffic between TACACS+ Peers by adding TLS support. This does not in itself protect the server nor clients; the operator and equipment vendors have a role. That role is to diligently follow current best practices for maintaining the integrity of network devices and selection of TLS key and encryption algorithms.¶
TLS encryption SHOULD be used in deployments when both the Clients and Servers support it. Servers that support TLS encryption MAY be configured to allow Unsecure Connections when TLS encryption is not supported by the Client, but this is NOT RECOMMENDED because of the threat of downgrade attacks, as described in Section 8.2. Unsecure Connections would be better served by separate Servers from the TLS Servers.¶
It is NOT RECOMMENDED to deploy TACACS+ without TLS authentication and encryption, including TLS using the NULL algorithm, except for within test and debug environments. Also see [RFC3365].¶
TLS 1.3 resumption and PSK techniques make it possible to send Early Data, aka. 0-RTT data, data that is sent before the TLS handshake completes. Replay of this data is possible. Given the sensitivity of TACACS+ data, a Client MUST NOT send data until the full TLS handshake completes; that is, Clients MUST NOT send 0-RTT data and Servers MAY abruptly disconnect Clients that do.¶
Implementations MAY support TLS authentication with Pre-Shared Keys (PSKs), also known as external PSKs in TLS 1.3, which are not resumption PSKs. PSKs SHOULD NOT be shared among Clients or Servers to limit exposure of a compromised key and to ease key rotation. Also see [RFC8773] and [I-D.ietf-tls-external-psk-guidance].¶
PSKs are otherwise considered out-of-scope for this document.¶
Unfortunately, no single and timely TLS recommendations document exists. Therefore, implementers and operators SHOULD make use of the various RFCs to determine which TLS versions and algorithms should be supported, deprecated, or abandoned, in the absence of updates to this document. Useful examples are the TLS specifications themselves (TLS 1.3 [RFC8446]), which prescribes mandatory support in Section 9, and TLS Recommendations [RFC7525].¶
Operators SHOULD be cognizant of the potential of Server and/or Client isolation from their Peer's Certificate Authority (CA) by network failures. Isolation from a public key certificate's CA will cause the verification of the certificate to fail and thus TLS authentication of the Peer to fail. Certificate caching and Raw Public Keys [RFC7250] are methods to address this, but both are out of scope for this document. Certificate fingerprints are another option.¶
A new port is considered appropriate and superior to a "STARTTLS" command or other negotiation method because it allows:¶
However, co-existence of inferior authentication and encryption, whether an Unsecure Connection or deprecated parts that compose TLS, also presents opportunity for down-grade attacks. Causing failure of connections to the TLS-enabled service or the negotiation of shared algorithm support are two such down-grade attacks. The simplest way to address the exposure from Unsecure Connection methods is to refuse Unsecure Connections at the server entirely, perhaps using separate servers for Unsecure Connections and TLS. Another approach is mutual configuration that requires TLS. Clients and Servers SHOULD support configuration that requires Peers, globally and individually, use TLS. Furthermore, Peers SHOULD be configurable to limit offered or recognized TLS versions and algorithms to those recommended by standards bodies and implementers.¶
Servers and Clients could also maintain a cache of Peers that have engaged in TACACS+ TLS connections and demand TLS from that point forward. However, this has potential to be a Denial of Service (DoS) vector, whereby an attacker causes a server to believe that a client that does not support TLS has successfully connected with TLS.¶
A Client MUST NOT cache SSH public keys received from a Server for future SSH client authentication. Doing so would deny the Server the opportunity to deny authentication for other reasons than key validity or to revoke a key. The Server has no method to revoke a key, except by not offering the key in future authentication sessions.¶
The authors request that, when this draft is accepted by the working group, the OPSAWG Chairs submit a request to IANA for an early allocation, per [RFC4020] and [RFC6335], of a new well-known system TCP/IP port number for the service name "tacacss", described as "TACACS+ over TLS". The service name "tacacss" follows the common practice of appending an "s" to the name given of the non-TLS well-known port. This allocation is justified in Section 8.2.¶
RFC EDITOR: this port number should replace "[TBD]" and the service name should replace "[TBDN]" within this document.¶
The author(s) would like to thank Russ Housley, Steven M. Bellovin, Stephen Farrell, Alan DeKok, Warren Kumari, and Tom Petch for their support, insightful review, and/or comments. [RFC5425] was also used as a basis for the approach to TLS.¶