Re: Shrubbery's tac_plus - inclusion in other products?

[Andrian Visnevschi via NANOG <nanog () lists nanog org>]

Not Shrubbery-based as far as I know, but in case it helps the inventory: I've had good experience with TACACSGUI(, 
which put a web UI on top of Marc Huber's tac_plus (https://github.com/MarcJHuber/event-driven-servers), a separate 
codebase from the Shrubbery fork.

TACACSGUI seems to have moved on to Taranac (https://github.com/TaranacLabs/taranac, https://taranac.pro/). I tested it 
recently in a few multivendor environments and it worked fine for both TACACS+ and RADIUS. Caveat, it ships as Docker 
images, the public repo has no source, and I don't know which TACACS+ daemon it uses internally.


[ITcare]
Andrian Visnevschi
Chief Executive & Technology Officer
Tel: +373 68 374 133  |  www.itcare.net<https://www.itcare.net/> | 
LinkedIn<https://www.linkedin.com/in/andrian-visnevschi-32a25526/>
Email: andrian.visnevschi () itcare net
ITcare, where perseverance meets commitment

________________________________
From: Drew Weaver via NANOG <nanog () lists nanog org>
Sent: Thursday, September 24, 2026 6:40 PM
To: 'North American Network Operators Group' <nanog () lists nanog org>
Cc: Drew Weaver <drew.weaver () thenap com>
Subject: RE: Shrubbery's tac_plus - inclusion in other products?

I think that Facebook's abandoned tacplus was based on shrubbery's but I'm not sure.

-Drew


-----Original Message-----
From: Royce Williams via NANOG <nanog () lists nanog org>
Sent: Wednesday, September 23, 2026 6:00 PM
To: North American Network Operators Group <nanog () lists nanog org>
Cc: Royce Williams <royce () techsolvency com>
Subject: Shrubbery's tac_plus - inclusion in other products?

Do any TACACS+-speaking solutions (current or legacy) have a basis on the Shrubbery fork of tac_plus?

There's an unauth'd RCE in just about all versions (no CVE yet):

https://eur06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__github.com_elttam_publications_blob_master_writeups_elttam-2Dtac-5Fplus-5Frce-5Ffmtstring-5Fadvisory.txt%26d%3DDwICAg%26c%3DeuGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM%26r%3DOPufM5oSy-PFpzfoijO_w76wskMALE1o4LtA3tMGmuw%26m%3DP4yMaLMt7_Y1DKgbkUcQFzi3cY9Dh55_g18Mh0YB-8dEvGkR7IVq9UHGxin8i-Ow%26s%3DGztpdM_T0RwX1tqgNXKgom_VxdSBS10VFFijoEVYBGI%26e%3D&data=05%7C02%7Candrian.visnevschi%40itcare.net%7Cc2051cf70ef44f034abf08df1a53ada1%7C14896a7e6123409ab3775398df4feb19%7C0%7C0%7C639258618830659809%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=oL5NPkDCOn0ooIZQdjJ9jSpMqbkLxvXupFlN8H7FRy8%3D&reserved=0<https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_elttam_publications_blob_master_writeups_elttam-2Dtac-5Fplus-5Frce-5Ffmtstring-5Fadvisory.txt&d=DwICAg&c=euGZstcaTDllvimEN8b7jXrw
 
qOf-v5A_CdpgnVfiiMM&r=OPufM5oSy-PFpzfoijO_w76wskMALE1o4LtA3tMGmuw&m=P4yMaLMt7_Y1DKgbkUcQFzi3cY9Dh55_g18Mh0YB-8dEvGkR7IVq9UHGxin8i-Ow&s=GztpdM_T0RwX1tqgNXKgom_VxdSBS10VFFijoEVYBGI&e=>

Some threat-intel folks are collecting what we know here (disclosure:
my post, but it's volunteer), so if anyone replies (here or on the side), I'll update here:

https://eur06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__ifin.network_t_cve-2Dpending-2Dpre-2Dauth-2Dformat-2Dstring-2Dbug-2Din-2Dtac-2Dplus-2Dshrubbery-2Dnetworks_859_1%26d%3DDwICAg%26c%3DeuGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM%26r%3DOPufM5oSy-PFpzfoijO_w76wskMALE1o4LtA3tMGmuw%26m%3DP4yMaLMt7_Y1DKgbkUcQFzi3cY9Dh55_g18Mh0YB-8dEvGkR7IVq9UHGxin8i-Ow%26s%3DBYkFW55mPH8_9qkQnMtTr8vQYRtQbrIA12Go63vY5fw%26e%3D&data=05%7C02%7Candrian.visnevschi%40itcare.net%7Cc2051cf70ef44f034abf08df1a53ada1%7C14896a7e6123409ab3775398df4feb19%7C0%7C0%7C639258618830690639%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=TF8Xskqk9kX1skqYAA71GykZjvsJiEdEj%2BaOtWGa0tc%3D&reserved=0<https://urldefense.proofpoint.com/v2/url?u=https-3A__ifin.network_t_cve-2Dpending-2Dpre-2Dauth-2Dformat-2Dstring-2Dbug-2Din-2Dtac-2Dplus-2Dshrubbery-2Dnetworks_859_1&d=DwICAg&c=euGZst
 
caTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=OPufM5oSy-PFpzfoijO_w76wskMALE1o4LtA3tMGmuw&m=P4yMaLMt7_Y1DKgbkUcQFzi3cY9Dh55_g18Mh0YB-8dEvGkR7IVq9UHGxin8i-Ow&s=BYkFW55mPH8_9qkQnMtTr8vQYRtQbrIA12Go63vY5fw&e=>

I'm interested in legacy / EOL platform info as well -- like some are still in the field. And upstream updates are 
sporadic (until this year when .31 was released, there hadn't been a release since .28 in 2015), so embedding could go 
way back.

I don't have vendor access anymore, so any feedback / corrections appreciated.

--
Royce Williams
Tech Solvency
_______________________________________________
NANOG mailing list
https://eur06.safelinks.protection.outlook.com/?url=https%3A%2F%2Furldefense.proofpoint.com%2Fv2%2Furl%3Fu%3Dhttps-3A__lists.nanog.org_archives_list_nanog-40lists.nanog.org_message_AY32ZYSY7ZRWSHNWZF74TNNHVZNYOY5I_%26d%3DDwICAg%26c%3DeuGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM%26r%3DOPufM5oSy-PFpzfoijO_w76wskMALE1o4LtA3tMGmuw%26m%3DP4yMaLMt7_Y1DKgbkUcQFzi3cY9Dh55_g18Mh0YB-8dEvGkR7IVq9UHGxin8i-Ow%26s%3Dd7uT22hZQSepHE3ZtQE11uwjAIe0bllav3v8os51_WA%26e%3D&data=05%7C02%7Candrian.visnevschi%40itcare.net%7Cc2051cf70ef44f034abf08df1a53ada1%7C14896a7e6123409ab3775398df4feb19%7C0%7C0%7C639258618830713747%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=5LwK2h7F4OKSw5TXI4M1IE5x37qZTJkJfp%2F764hlAEk%3D&reserved=0<https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.nanog.org_archives_list_nanog-40lists.nanog.org_message_AY32ZYSY7ZRWSHNWZF74TNNHVZNYOY5I_&d=DwICAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfi
 
iMM&r=OPufM5oSy-PFpzfoijO_w76wskMALE1o4LtA3tMGmuw&m=P4yMaLMt7_Y1DKgbkUcQFzi3cY9Dh55_g18Mh0YB-8dEvGkR7IVq9UHGxin8i-Ow&s=d7uT22hZQSepHE3ZtQE11uwjAIe0bllav3v8os51_WA&e=>
_______________________________________________
NANOG mailing list
https://eur06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.nanog.org%2Farchives%2Flist%2Fnanog%40lists.nanog.org%2Fmessage%2FYGXUGL2KTBH3GHUMLRIOGA4BK73XRUC6%2F&data=05%7C02%7Candrian.visnevschi%40itcare.net%7Cc2051cf70ef44f034abf08df1a53ada1%7C14896a7e6123409ab3775398df4feb19%7C0%7C0%7C639258618830734900%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=jiL2Y%2F7o47pzBxvjwJGYiKH%2BQwTdW2Fnz3Xwa6Xo5IE%3D&reserved=0<https://lists.nanog.org/archives/list/nanog
 () lists nanog org/message/YGXUGL2KTBH3GHUMLRIOGA4BK73XRUC6/>
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/QFJDYESFW6ERONDTBBR4WOK6GPAQRLTO/