Re: Shrubbery's tac_plus - inclusion in other products?

[Saku Ytti via NANOG <nanog () lists nanog org>]

Not answering your question, but I've previously used 'radiator' in
two companies in the past and have been very happy with the product.

https://radiatorsoftware.com/products/radiator/

I've used the original perl version, not the current rust version, but
I was always happy with it.

We had both TACACS and Radius tied to Microsoft AD, so credentials
management was from single place (obviously it is easier to make your
unixy systems play with windows, than windows to play with your unixy
systems) and protocol agnostic. We didn't have to separately manage
TACACS and Radius boxes in any way.

On Thu, 24 Sept 2026 at 01:01, Royce Williams via NANOG
<nanog () lists nanog org> wrote:
> Do any TACACS+-speaking solutions (current or legacy) have a basis on
> the Shrubbery fork of tac_plus?
>
> There's an unauth'd RCE in just about all versions (no CVE yet):
>
> https://github.com/elttam/publications/blob/master/writeups/elttam-tac_plus_rce_fmtstring_advisory.txt
>
> Some threat-intel folks are collecting what we know here (disclosure:
> my post, but it's volunteer), so if anyone replies (here or on the
> side), I'll update here:
>
> https://ifin.network/t/cve-pending-pre-auth-format-string-bug-in-tac-plus-shrubbery-networks/859/1
>
> I'm interested in legacy / EOL platform info as well -- like some are
> still in the field. And upstream updates are sporadic (until this year
> when .31 was released, there hadn't been a release since .28 in 2015),
> so embedding could go way back.
>
> I don't have vendor access anymore, so any feedback / corrections appreciated.
>
> --
> Royce Williams
> Tech Solvency
> _______________________________________________
> NANOG mailing list
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/AY32ZYSY7ZRWSHNWZF74TNNHVZNYOY5I/



-- 
  ++ytti
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/Q2TDECSF4WUU46WAAMIMCZIXREF4ON7E/