What is a difference between RADIUS and TACACS+?

The most significant architectural difference between TACACS+ and RADIUS lies in

how they handle the components of AAA (Authentication, Authorization, and

Accounting). TACACS+ separates these three functions. This modularity allows for

greater flexibility; for instance, you can use one server for authentication and a different

one for authorization. In contrast, RADIUS combines the authentication and

authorization processes. When a RADIUS server receives an access request, it

authenticates the user and, in the same response packet (Access-Accept), returns the

authorization information. This fundamental design difference makes TACACS+ more

flexible for complex network environments.

•

A. RADIUS is most appropriate for dial authentication, but TACACS+ can be

used for multiple types of authentication: This is misleading. While RADIUS

originated with dial-up services, both protocols are now widely used for various

network access types, including wireless, VPNs, and device administration. This

option doesn't represent a core, definitive difference.

•

B. TACACS+ encrypts only password information and RADIUS encrypts the

entire payload: This statement is factually reversed. TACACS+ encrypts the

entire packet payload, providing greater confidentiality for all session data.

/561

RADIUS only encrypts the password within the Access-Request packet,

leaving other information like the username and requested service in cleartext.

•

D. RADIUS logs all commands that are entered by the administrator, but

TACACS+ logs only start, stop, and interim commands: This is also factually

reversed. A key advantage of TACACS+ is its ability to support per-command

authorization and accounting, allowing for very granular logging of an

administrator's actions. RADIUS's accounting is generally less detailed, typically

limited to start/stop records.

1. Cisco: TACACS+ and RADIUS Comparison. "TACACS+ separates the

authentication, authorization, and accounting (AAA) functions... RADIUS

combines authentication and authorization." This document also confirms

TACACS+ encrypts the entire packet body, while RADIUS only encrypts the

password.

o URL: https://www.cisco.com/c/en/us/support/docs/security-vpn/remoteauthentication-dial-user-service-radius/13838-10.html

o Reference: Sections "TACACS+ and RADIUS" and "Key Features".

2. IETF RFC 8907: The Terminal Access Controller Access-Control System Plus

(TACACS+) Protocol. This RFC defines the protocol and its architecture.

o URL: https://doi.org/10.17487/RFC8907

o Reference: Section 1 (Introduction) states, "The... (TACACS+) protocol...

provides for separate and modular authentication, authorization, and

accounting (AAA) facilities." Section 4.1 confirms the entire packet

payload is encrypted.

3. IETF RFC 2865: Remote Authentication Dial In User Service (RADIUS). This

RFC defines the RADIUS protocol.

o URL: https://doi.org/10.17487/RFC2865

o Reference: Section 3 describes the combined nature of the Access-

Request and Access-Accept packets, where authorization information is

returned upon successful authentication. Section 5.2 defines the User-

Password attribute as the primary field undergoing encryption.

/561