跳到主要内容

RFC 9887 - 技术摘要 (英文版本)

文档: Terminal Access Controller Access-Control System Plus (TACACS+) over TLS 1.3 RFC Number: 9887 Publication Date: December 2025 Status: PROPOSED STANDARD Updates: RFC 8907

快速参考卡​

关键要求 (MUST)​

RequirementSpecificationSection
TLS VersionTLS 1.3 minimum3.2
Port NumberTCP 300 for TLS3.1, 7
AuthenticationMutual (client + server)3.1
Certificate ValidationFull path + revocation3.4.1
ObfuscationMUST NOT use with TLS4
Unencrypted FlagMUST be set to 14
0-RTT DataMUST NOT send5.1.2
FallbackMUST NOT to non-TLS5.1.1

支持的认证方法​

  1. Certificate-Based (MANDATORY)

    • 使用 X.509 certificates 并执行完整链验证
    • 必须执行撤销检查
    • 使用 DNS-ID, IP-ID, 或 SRV-ID 标识服务器身份
    • 必须支持 SNI extension

  2. Pre-Shared Keys (PSK) (OPTIONAL)

    • External PSKs (不是 resumption PSKs)
    • 最小长度为 16 octets
    • MUST 与 obfuscation shared secrets 不同

  3. Raw Public Keys (RPK) (OPTIONAL)

    • 不在本文档范围内
    • 详情见 RFC 7250

端口分配​

ServicePortProtocolUsage
TACACS+ (legacy)49TCPNon-TLS connections
TACACS+ over TLS300TCPTLS 1.3+ connections

IANA Registration: service name "tacacss", port 300/TCP

TLS 配置要求​

强制密码套件​

  • TLS 1.3 mandatory suites (RFC 8446 Section 9.1)
  • 应允许运维人员配置

证书要求​

  • Path Validation: RFC 5280 Section 6
  • Identity Validation: RFC 9525
  • Revocation: 必须在初始连接和恢复期间检查
  • SNI: 必须支持 (RFC 6066 Section 3)

禁止的特性​

  • ❌ TLS versions < 1.3
  • ❌ 0-RTT early data
  • ❌ Upgrade from non-TLS
  • ❌ MD5-based obfuscation
  • ❌ Fallback to non-TLS

连接生命周期​

Client                                    Server
  |                                          |
  |--- TCP Connect to port 300 ------------>|
  |                                          |
  |&lt;-- TLS 1.3 Handshake (mutual auth) ---->|
  |                                          |
  |--- TACACS+ Data (TLS app data) -------->|
  |&lt;-- TACACS+ Response -------------------|
  |                                          |
  |--- Close (after session or timeout) --->|

连接模式​

  1. Single Connection Mode (RFC 8907 Section 4.3)

    • 多个 TACACS+ sessions 共用一个 TLS connection
    • 受 inactivity timeout 约束
    • 连接可能短暂保持

  2. Non-Single Connection Mode

    • 每个 TLS connection 承载一个 TACACS+ session
    • session 完成后关闭 TCP

TLS Resumption​

  • Ticket Lifetime: 应可配置 (包括 0 seconds)
  • Single Use: 每个 ticket 仅用于一次 resumption
  • Revocation Check: 在 resumption period 内必须执行
  • Server Behavior: 如果 ticket 有效且未使用, 应允许恢复

安全考虑摘要​

已处理的威胁模型​

ThreatMitigation
EavesdroppingTLS 1.3 encryption
Man-in-the-MiddleMutual authentication
Replay AttacksNo 0-RTT, nonce mechanisms
Downgrade AttacksSeparate ports, no fallback
Weak CryptoMD5 obsoleted, TLS 1.3 only

部署安全​

  1. TLS and non-TLS Separation

    • RECOMMENDED: 使用独立物理主机
    • MUST: 使用独立端口号
    • 防止误配置暴露风险

  2. Certificate Management

    • 遵循 BCP 195 (RFC 7525)
    • Wildcard certificates: 限定在专用子域内
    • CA reachability: 为网络隔离场景制定计划

  3. Configuration Clarity

    • 明确标识 TLS/non-TLS mode
    • 对端口不匹配给出验证警告
    • 使用独立配置章节

迁移策略 (5 Phases)​

Phase 1: Assessment​

  • 清点所有 TACACS+ clients 和 servers
  • 识别 TLS-capable 设备和 legacy devices
  • 规划网络拓扑变更

Phase 2: Pilot​

  • 在测试环境中于 port 300 部署 TLS servers
  • 配置测试客户端
  • 验证证书基础设施

Phase 3: Initial Deployment​

  • 迁移一部分生产 clients
  • 监控问题
  • 维护并行 non-TLS infrastructure

Phase 4: Gradual Rollout​

  • 逐步迁移剩余 clients
  • 记录所有 legacy device exceptions
  • 为 non-TLS 实施补偿性控制

Phase 5: Completion​

  • 下线 non-TLS infrastructure
  • 完成最终安全审计
  • 更新文档

关键规则: 如果 TLS 失败, clients MUST NOT 回退到 non-TLS

实现检查清单​

Server Implementation​

  • TLS 1.3 support (minimum)
  • Listen on port 300 (or configured alternative)
  • Certificate-based mutual authentication
  • Certificate path validation (RFC 5280)
  • Revocation checking
  • SNI extension support
  • Reject packets without TAC_PLUS_UNENCRYPTED_FLAG
  • Reject 0-RTT data
  • TLS resumption support
  • Configurable ticket lifetime
  • Optional: PSK authentication
  • Optional: Raw Public Keys

Client Implementation​

  • TLS 1.3 support (minimum)
  • Connect to port 300 (or configured)
  • Immediate TLS negotiation (no upgrade)
  • Certificate validation
  • SNI extension in ClientHello
  • Set TAC_PLUS_UNENCRYPTED_FLAG = 1
  • No 0-RTT data transmission
  • No fallback to non-TLS
  • TLS resumption support
  • Optional: PSK authentication
  • Optional: Raw Public Keys

参考实现说明​

证书身份验证​

Acceptable Identifier Types:
- DNS-ID: tacacs.example.com
- IP-ID: 192.0.2.1 or 2001:db8::1
- SRV-ID: _tacacs._tcp.example.com

NOT Acceptable:
- URI-ID (not used for TACACS+)

通配符证书​

✅ GOOD: *.tacacs.example.com (dedicated subdomain)
❌ BAD:  *.example.com (too broad)

PSK 身份格式​

- Minimum length: 16 octets
- Follow RFC 9257 Section 6.1
- Must differ from obfuscation secrets

运维最佳实践​

  1. Monitoring

    • 记录所有 TLS handshake failures
    • 对发往 port 300 的 non-TLS connection attempts 告警
    • 跟踪证书过期日期

  2. Certificate Lifecycle

    • 自动化续期 (e.g., ACME protocol)
    • 在本地维护 certificate chains
    • 为 CA outages 制定计划

  3. Testing

    • 定期执行 TLS configuration audits
    • 执行 cipher suite compatibility testing
    • 验证 failover scenarios

  4. Documentation

    • 维护 TLS vs non-TLS servers 清单
    • 记录迁移时间线
    • 记录 certificate trust anchors

合规要求​

FIPS 140-3​

  • TLS 1.3 with approved cipher suites
  • MD5 obfuscation 已废止 (non-compliant)
  • 建议使用 certificate-based authentication

行业标准​

  • PCI DSS: 要求强加密
  • NIST SP 800-52: TLS guidelines
  • BCP 195: TLS best practices

应避免的常见陷阱​

  1. ❌ Port Mismatch: TLS client 连接到 port 49
  2. ❌ Fallback Logic: TLS 失败后尝试 non-TLS
  3. ❌ Mixed Secrets: 对 obfuscation 和 PSK 使用相同密钥
  4. ❌ 0-RTT Enabled: 发送 early data
  5. ❌ Certificate Validation Disabled: 接受无效证书
  6. ❌ Same Host: 在同一 server 上运行 TLS 和 non-TLS
  7. ❌ Wildcard Abuse: 对所有服务使用 *.example.com
  8. ❌ No Revocation Check: 跳过 CRL/OCSP validation

性能考虑​

TLS 握手开销​

  • Full Handshake: ~2 RTT (TLS 1.3)
  • Resumption: ~1 RTT
  • Mitigation: 对重复连接使用 resumption

连接持久性​

  • Single Connection Mode 减少握手频率
  • 在连接复用和 timeout settings 之间取得平衡
  • 典型 timeout: 60-300 seconds

证书验证​

  • 缓存已验证的证书
  • 使用 OCSP stapling 降低延迟
  • 考虑 TLS Cached Information Extension (RFC 7924)

故障排查指南​

SymptomPossible CauseSolution
Connection refusedWrong port检查 client 是否配置为 port 300
Handshake failureTLS version mismatch确保支持 TLS 1.3
Certificate errorInvalid cert chain验证 CA trust 和 certificate validity
Authentication failedMutual auth issue检查 client 和 server certificates
TAC_PLUS_UNENCRYPTED_FLAG errorFlag not set确保 client 将 flag 设置为 1
Resumption rejectedTicket expired/used正常情况, 将继续 full handshake

未来考虑​

YANG Data Model​

  • 需要标准化配置模型
  • 有助于自动化和一致性
  • 应包含 TLS-specific parameters

协议扩展​

  • 本文档聚焦 TLS 1.3
  • 预期未来 TLS versions 也可工作
  • 跟踪 IETF TLS WG 更新

IPv6 部署​

  • IPv6 建议无需改变
  • TLS 在 IPv4 和 IPv6 上工作方式相同
  • 对基于 IP 的证书身份使用 IP-ID

快速决策树​

Do you need TACACS+ security?
├─ YES → Use TLS (this RFC)
│   ├─ Modern devices → Certificate-based auth
│   ├─ Constrained devices → Consider PSK
│   └─ Legacy devices → Separate non-TLS infrastructure
│
└─ NO → Consider if TACACS+ is appropriate
    └─ High-security environments require TLS

相关 RFC​

  • RFC 8907: Base TACACS+ Protocol (updated by this RFC)
  • RFC 8446: TLS 1.3 (transport layer)
  • RFC 5280: X.509 PKI (certificates)
  • RFC 9525: Service Identity in TLS (identity validation)
  • RFC 9257: External PSK Guidance
  • RFC 7525 (BCP 195): TLS Best Practices

文档状态​

  • Standards Track: Yes
  • Implementation Required: For new deployments
  • Backward Compatibility: Parallel operation during migration
  • Obsoletes: MD5 obfuscation mechanism only
  • Updates: RFC 8907 (adds TLS profile)

Last Updated: December 26, 2025 Document Version: 1.0 (Complete English Version) Maintained By: RFC Translation Project

最后于 更新