Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

we have running tacacs environment for centralised login to our routers, firewalls etc and even most of our linux boxes to ssh

what we would like to do is allow users to authenticate to SSH via public key auth rather than having to type there password in, but still authorize via tacacs to check that login is indeed allowed and access should be granted, but if the user is disabled in tacacs it should be rejected

is that possible and how would it be achieved - we are using RedHat/Centos with pam_tacplus

secondary related question: how would you allow specific system accounts to bypass tacacs authentication so that server to server scripts could run via SSH and public key auth without the need to exist in tacacs also

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.