A minimalist TACACS+ appliance. Provides a simple graphical frontend and hardened implementation.
470
Warning
This software should be considered a prototype, and it has not been independently assessed, use appropriate risk management before deploying.
TACACS+ itself does not implement HMAC, an MITM attacker can bypass authentication, consider adding a VPN between your on-prem middleboxes and this server if there is any risk of an interloper with access to manipulate the management network traffic; such as at an inline-IPS, or locally via ARP poisoning. See RFC8907 and other applicable security guidance for deploying AAA Services securely.
ratchet-cycle is a free and open-source TACACS+ authentication server, available here, as a Docker container.
In order to operate ratchet-cycle the following environment variable should define a secure AES256 key:
RATCHET_PAWL_MASKING_KEY used to encrypt sensitive fields which are explicitly persisted to the container's disk.
The container exposes two ports:
Finally, on first launch the logs for the application will display a user with name DefaultRatchetUser, and a generally unpredictable, difficult to guess password, which can be used for initial login and configuration.
ratchet-cycle does not operate the VOLUME mechanism of Docker, it is recommended to configure a VOLUME for the database; a single file, /ratchet/ratchet_db.redb produced by the image. This may be a feature in future versions
See the README in the source repo for more details: https://github.com/meltyness/ratchet-cycle
Content type
Image
Digest
sha256:2d2b4e82e…
Size
94 MB
Last updated
over 1 year ago
docker pull meltyness/ratchet-cycle