Configure your AnywhereUSB Plus device to use a TACACS+ server

This section describes how to configure a AnywhereUSB Plus device to use a TACACS+ server for authentication and authorization.

Required configuration items

Define the TACACS+ server IP address or domain name.
Define the TACACS+ server shared secret.
The group attribute configured in the TACACS+ server configuration.
The service field configured in the TACACS+ server configuration.
Add TACACS+ as an authentication method for your AnywhereUSB Plus device.

Additional configuration items

Whether other user authentication methods should be used in addition to the TACACS+ server, or if the TACACS+ server should be considered the authoritative login method.
Enable command authorization, so that the device will communicate with the TACACS+ server to determine if the user is authorized to execute a specific command.
Enable command accounting, so that the device will communicate with the TACACS+ server to log commands that the user executes.
The TACACS+ server port. It is configured to 49 by default.
Add additional TACACS+ servers in case the first TACACS+ server is unavailable.

 Web

Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
Access the device configuration:
Remote Manager:
1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
2. Click the Device ID.
3. Click Settings.
4. Click to expand Config.
Local Web UI:
1. On the menu, click System. Under Configuration, click Device Configuration.
  The Configuration window is displayed.
Click Authentication > TACACS+ > Servers.
Add TACACS+ servers:
1. For Add server, click .
2. For Hostname, type the hostname or IP address of the TACACS+ server.
3. (Optional) Change the default Port setting to the appropriate port. Normally this should be left at the default setting of port 49.
4. For Secret, type the TACACS+ server's shared secret. This is configured in the key parameter of the TACACS+ server's tac_plus.conf file, for example:
```
key = testing123
```
  Note DAL authentication does not support the use of the # character in the key (e.g., DAL#123;&). If included, the server will be unable to decipher the request.
5. (Optional) Click  again to add additional TACACS+ servers.
(Optional) Enable Authoritative to prevent other authentication methods from being attempted if TACACS+ login fails.
(Optional) For Group attribute, type the name of the attribute used in the TACACS+ server's configuration to identify the AnywhereUSB Plus authentication group or groups that the user is a member of. For example, in TACACS+ user configuration, the group attribute in the sample tac_plus.conf file is groupname, which is also the default setting in the AnywhereUSB Plus configuration.
(Optional) For Service, type the value of the service attribute in the the TACACS+ server's configuration. For example, in TACACS+ user configuration, the value of the service attribute in the sample tac_plus.conf file is system, which is also the default setting in the AnywhereUSB Plus configuration.
(Optional) Enable Command authorization, which instructs the device to communicate with the TACACS+ server to determine if the user is authorized to execute a specific command. Only the first configured TACACS+ server will be used for command authorization.
(Optional) Enable Command accounting, which instructs the device to communicate with the TACACS+ server to log commands that the user executes. Only the first configured TACACS+ server will be used for command accounting.
Add TACACS+ to the authentication methods:
1. Click Authentication > Methods.
2. For Add method, click .
3. Select TACACS+ for the new method from the Method drop-down.
Authentication methods are attempted in the order they are listed until an authentication response, either pass or fail, is received. If Authoritative is enabled (see above), non-authoritative methods are not attempted. See Rearrange the position of authentication methods for information about rearranging the position of the methods in the list.
Click Apply to save the configuration and apply the change.

 Command line

Select the device in Remote Manager and click Actions > Open Console, or log into the AnywhereUSB Plus local command line as a user with full Admin access rights.
Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.
At the command line, type config to enter configuration mode:
```
> config
(config)>
```
(Optional) Prevent other authentication methods from being used if TACACS+ authentication fails. Other authentication methods will only be used if the TACACS+ server is unavailable.
```
(config)> auth tacacs+ authoritative true
(config)>
```
(Optional) Configure the group_attribute. This is the name of the attribute used in the TACACS+ server's configuration to identify the AnywhereUSB Plus authentication group or groups that the user is a member of. For example, in TACACS+ user configuration, the group attribute in the sample tac_plus.conf file is groupname, which is also the default setting for the group_attribute in the AnywhereUSB Plus configuration.
```
(config)> auth tacacs+ group_attribute attribute-name
(config)> 
```
(Optional) Configure the type of service. This is the value of the service attribute in the the TACACS+ server's configuration. For example, in TACACS+ user configuration, the value of the service attribute in the sample tac_plus.conf file is system, which is also the default setting in the AnywhereUSB Plus configuration.
```
(config)> auth tacacs+ service service-name
(config)> 
```
(Optional) Enable command authorization, which instructs the device to communicate with the TACACS+ server to determine if the user is authorized to execute a specific command. Only the first configured TACACS+ server will be used for command authorization.
```
(config)> auth tacacs+ command_authorization true
(config)> 
```
(Optional) Enable command accounting, which instructs the device to communicate with the TACACS+ server to log commands that the user executes. Only the first configured TACACS+ server will be used for command accounting.
```
(config)> auth tacacs+ command_accounting true
(config)> 
```

Add a TACACS+ server:

Add the server:

(config)> add auth tacacs+ server end
(config auth tacacs+ server 0)>

Enter the TACACS+ server's IP address or hostname:

(config auth tacacs+ server 0)> hostname hostname|ip-address
(config auth tacacs+ server 0)>

(Optional) Change the default port setting to the appropriate port:

(config auth tacacs+ server 0)> port port
(config auth tacacs+ server 0)>

(Optional) Repeat the above steps to add additional TACACS+ servers.

Add TACACS+ to the authentication methods. Authentication methods are attempted in the order they are listed until the first successful authentication result is returned. This example will add TACACS+ to the end of the list. See User authentication methods for information about adding methods to the beginning or middle of the list.
```
(config)> add auth method end tacacs+
(config)> 
```
Save the configuration and apply the change.
```
(config)> save
Configuration saved.
>
```
Type exit to exit the Admin CLI.
Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.