Subject: Re: [OPSAWG] Detangling - Q3: Publish TACACS+ as a standards track RFC?

From: Christopher Morrow <[email-masked]>
Date: Wed, 6 Apr 2016 12:46:22 -0400

​(I hate to resurrect an old thread. but)​

On Mon, Feb 22, 2016 at 10:37 AM, Alan DeKok <[email-masked]>
wrote:

>   And since TACACS+ is largely used *within* the enterprise, the issue of
> securing it is less relevant than (say) RADIUS, which is used across the
> wider internet.

​This is flat wrong. Tac+ is used across the wide-area, both within a
single routing administrative domain (Autonomous system, single company
network) and wit​hout.

-chris

---

From: Alan DeKok <[email-masked]>
Date: Wed, 6 Apr 2016 13:26:17 -0400

> On Apr 6, 2016, at 12:46 PM, Christopher Morrow <[email-masked]> wrote:
> 
> On Mon, Feb 22, 2016 at 10:37 AM, Alan DeKok <[email-masked]> wrote:
>   And since TACACS+ is largely used *within* the enterprise, the issue of securing it is less relevant than (say) RADIUS, which is used across the wider internet.
> 
> ​This is flat wrong. Tac+ is used across the wide-area, both within a single routing administrative domain (Autonomous system, single company network)

  As I said.

> and wit​hout.

  That which is asserted without evidence can be dismissed without evidence.

  I'll note that the existing document doesn't describe this scenario at all.  So you're asserting (again) that we should be standardizing TACACS+ because of use-cases which are so important that they're not even mentioned in the document.  Or on this mailing list, so far as I've been able to find.

  I find blind assertions entirely unconvincing.

  Alan DeKok.