<?xml version="1.0" encoding="US-ASCII"?>
<!-- edited with XMLSPY v5 rel. 3 U (http://www.xmlspy.com)
     by Daniel M Kohn (private) --> encoding="UTF-8"?>

<!DOCTYPE rfc SYSTEM "rfc2629.dtd" [
<!ENTITY rfc2119 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml">
<!ENTITY RFC3775 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.3775.xml">
<!ENTITY RFC4225 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4225.xml">
<!ENTITY RFC4866 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.4866.xml">
<!ENTITY RFC5213 SYSTEM "http://xml.resource.org/public/rfc/bibxml/reference.RFC.5213.xml">
<!-- added by sjjeong: -->
<!ENTITY I-D.ietf-netlmm-pmip6-ipv4-support PUBLIC "" "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-netlmm-pmip6-ipv4-support.xml">
<!ENTITY I-D.ietf-netlmm-grekey-option PUBLIC "" "http://xml.resource.org/public/rfc/bibxml3/reference.I-D.ietf-netlmm-grekey-option.xml">
]> "rfc2629-xhtml.ent">

<rfc category="std" xmlns:xi="http://www.w3.org/2001/XInclude" docName="draft-ietf-opsawg-tacacs-yang-12"
     ipr="trust200902">
  <?xml-stylesheet type='text/xsl' href='rfc2629.xslt' ?>

  <?rfc toc="yes" ?>

  <?rfc symrefs="yes" ?>

  <?rfc sortrefs="yes"?>

  <?rfc iprnotified="no" ?>

  <?rfc strict="yes" ?> number="9105" ipr="trust200902" obsoletes="" updates="" submissionType="IETF" category="std" consensus="true" xml:lang="en" tocInclude="true" symRefs="true" sortRefs="true" version="3">

  <front>
    <title abbrev="TACACS+ YANG module">A Data Model">A YANG Module Data Model for TACACS+</title> Terminal Access
    Controller Access-Control System Plus (TACACS+)</title>
    <seriesInfo name="RFC" value="9105"/>
    <author fullname="Bo Wu" initials="B." role="editor" surname="Wu">
      <organization abbrev="Huawei">Huawei Technologies, Co.,
      Ltd</organization>
      <address>
        <postal>
	  <extaddr>Yuhua District</extaddr>
	  <street>101 Software Avenue, Yuhua District</street> Avenue</street>
          <city>Nanjing</city>
          <region>Jiangsu</region>
          <code>210012</code>
          <country>China</country>
        </postal>
        <email>lana.wubo@huawei.com</email>
      </address>
    </author>
    <author fullname="Guangying Zheng" initials="G." surname="Zheng">
      <organization abbrev="Huawei">Huawei Technologies, Co.,
      Ltd</organization>
      <address>
        <postal>
	  <extaddr>Yuhua District</extaddr>
          <street>101 Software Avenue, Yuhua District</street> Avenue</street>
          <city>Nanjing</city>
          <region>Jiangsu</region>
          <code>210012</code>
          <country>China</country>
        </postal>
        <email>zhengguangying@huawei.com</email>
      </address>
    </author>
    <author fullname="Michael Wang" initials="M." role="editor" surname="Wang">
      <organization abbrev="Huawei">Huawei Technologies, Co.,
      Ltd</organization>
      <address>
        <postal>
	  <extaddr>Yuhua District</extaddr>
          <street>101 Software Avenue, Yuhua District</street>

          <street/> Avenue</street>
          <city>Nanjing</city>

          <region/>
          <code>210012</code>
          <country>China</country>
        </postal>
        <email>wangzitao@huawei.com</email>
      </address>
    </author>
    <date year="2021"/>

    <area>Ops Area</area>

    <workgroup>Opsawg</workgroup> year="2021" month="August" />
    <area>Operations and Management</area>
    <workgroup>OPSAWG</workgroup>

<keyword>Authentication</keyword>
<keyword>Authorization</keyword>
<keyword>Accounting</keyword>
<keyword>Authentication, Authorization, and Accounting</keyword>
<keyword>AAA</keyword>
<keyword>(AAA)</keyword>

    <abstract>
      <t>This document defines a Terminal Access Controller Access-Control
      System Plus (TACACS+) client YANG module, module that augments the System
      Management data model, defined in RFC 7317, to allow devices to make use
      of TACACS+ servers for centralized Authentication, Authorization Authorization, and
      Accounting (AAA). Though being a standard module, this module does not
      endorse the security mechanisms of the TACACS+ protocol (RFC 8907) 8907), and
      TACACS+ MUST <bcp14>MUST</bcp14> be used within a secure deployment.</t>
      <t>The YANG module in this document conforms to the Network Management
      Datastore Architecture (NMDA) defined in RFC 8342.</t>
    </abstract>
  </front>

  <middle>
    <section title="Introduction"> numbered="true" toc="default">
      <name>Introduction</name>
      <t>This document defines a YANG module that augments the System
      Management data model defined in the <xref target="RFC7317"/> target="RFC7317" format="default"/> to support
      the configuration and management of TACACS+ clients.</t>
      <t>TACACS+ <xref target="RFC8907"/> target="RFC8907" format="default"/> provides device
      administration for routers, network access servers servers, and other networked
      devices via one or more centralized servers.</t>
      <t><xref target="RFC7317">The target="RFC7317" format="default">The System Management Model</xref> data model</xref> defines
      separate functionality to support local and RADIUS authentication: <list
          style="symbols">
          <t>User </t>
<dl>
<dt>User Authentication Model: Defines </dt>
<dd>Defines a list of usernames with associated passwords and a configuration
leaf to decide the order in which local or RADIUS authentication is used.</t>

          <t>RADIUS used.  </dd>

<dt>RADIUS Client Model: Defines </dt>
<dd>Defines a list of RADIUS servers used by a device for centralized user authentication.</t>
        </list></t>
authentication.  </dd>
</dl>

  <t>The System Management Model data model is augmented with the TACACS+ YANG module
      defined in this document to allow the use of TACACS+ servers as an
      alternative to RADIUS servers.</t>
      <t>The YANG module can be used with network management protocols such as
      NETCONF<xref target="RFC6241"/>.</t>
      the Network Configuration Protocol (NETCONF) <xref target="RFC6241"
      format="default"/>.</t>
      <t>The YANG module in this document conforms to the Network Management
      Datastore Architecture (NMDA) defined in <xref target="RFC8342"/>.</t> target="RFC8342" format="default"/>.</t>
    </section>
    <section title="Conventions used numbered="true" toc="default">
      <name>Conventions Used in this document">
      <t>The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
      "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", This Document</name>

        <t>
    The key words "<bcp14>MUST</bcp14>", "<bcp14>MUST NOT</bcp14>",
    "<bcp14>REQUIRED</bcp14>", "<bcp14>SHALL</bcp14>", "<bcp14>SHALL
    NOT</bcp14>", "<bcp14>SHOULD</bcp14>", "<bcp14>SHOULD NOT</bcp14>",
    "<bcp14>RECOMMENDED</bcp14>", "<bcp14>NOT RECOMMENDED</bcp14>",
    "<bcp14>MAY</bcp14>", and
      "OPTIONAL" "<bcp14>OPTIONAL</bcp14>" in this document are
    to be interpreted as described in BCP14, BCP&nbsp;14 <xref target="RFC2119"/>, target="RFC2119"/>
    <xref target="RFC8174"/> when, and only when, they appear in all capitals,
    as shown here.</t> here.
        </t>

 <t>The following terms are defined in <xref target="RFC6241"/> target="RFC6241" format="default"/> and are
      used in this specification: <list style="symbols">
          <t>configuration data</t>

          <t>state data</t>
        </list></t> </t>
      <ul spacing="normal">
        <li>configuration data</li>
        <li>state data</li>
      </ul>
      <t>The following terms are defined in <xref target="RFC7950"/> target="RFC7950" format="default"/> and are
      used in this specification: <list style="symbols">
          <t>augment</t>

          <t>data model</t>

          <t>data node</t>
        </list>The </t>
      <ul spacing="normal">
        <li>augment</li>
        <li>data model</li>
        <li>data node</li>
      </ul>
      <t>The terminology for describing YANG data models is found in
      <xref target="RFC7950"/>.</t> target="RFC7950" format="default"/>.</t>
      <section anchor="tree-diagrams" title="Tree Diagrams"> numbered="true" toc="default">
        <name>Tree Diagrams</name>
        <t>The tree diagram used in this document follows the notation defined
        in <xref target="RFC8340"/>.</t> target="RFC8340" format="default"/>.</t>
      </section>
    </section>
    <section title="Design numbered="true" toc="default">

      <name>Design of the TACACS+ Data Model"> Model</name>
      <t>This module is used to configure a TACACS+ client on a device to
      support deployment scenarios with centralized authentication,
      authorization, and accounting servers. Authentication is used to
      validate a user's username and password, authorization allows the user
      to access and execute commands at various privilege levels assigned to
      the user, and accounting keeps track of the activity of a user who has
      accessed the device.</t>
      <t>The ietf-system-tacacs-plus module augments the "/sys:system" path
      defined in the ietf-system module with the contents of the "tacacs-plus"
      grouping. Therefore, a device can use local, RADIUS, or TACACS+ authentication to
      validate users who attempt to access the router by several mechanisms,
      e.g., a command line interface or a web-based user interface.</t>

      <t>The "server" list list, which is directly under the "tacacs-plus" container,
      which
      holds a list of TACACS+ servers and uses server-type to
      distinguish between Authentication, Authorization Authorization, and Accounting (AAA). (AAA) services.
      The list of servers is for redundancy.</t>
      <t>Most of the parameters in the "server" list are taken directly from
      the <xref target="RFC8907">the TACACS+ target="RFC8907" format="default">TACACS+ protocol </xref>,
      and some are derived from the various implementations by network
      equipment manufacturers. For example, when there are multiple interfaces
      connected to the TACACS+ client or server, the source address of
      outgoing TACACS+ packets could be specified, or the source address could
      be specified through the interface IP address setting, setting or derived from
      the outbound interface from the local Forwarding Information Base
      (FIB). For the TACACS+ server located in a Virtual Private Network
      (VPN), a VPN Routing and Forwarding (VRF) instance needs to be
      specified.</t>
      <t>The "statistics" container under the "server list" is a collection of
      read-only counters for sent and received messages from a configured
      server.</t>
      <t>The YANG module for TACACS+ client has the following structure:</t>

      <figure>
        <artwork><![CDATA[
      <sourcecode name="ietf-system-tacacs-plus" type="yangtree"><![CDATA[
module: ietf-system-tacacs-plus
  augment /sys:system:
    +--rw tacacs-plus
       +--rw server* [name]
          +--rw name                      string
          +--rw server-type               tacacs-plus-server-type
          +--rw address                   inet:host
          +--rw port?                     inet:port-number
          +--rw (security)
          |  +--:(obfuscation)
          |     +--rw shared-secret?      string
          +--rw (source-type)?
          |  +--:(source-ip)
          |  |  +--rw source-ip?          inet:ip-address
          |  +--:(source-interface)
          |     +--rw source-interface?   if:interface-ref
          +--rw vrf-instance?
          |       -> /ni:network-instances/network-instance/name
          +--rw single-connection?        boolean
          +--rw timeout?                  uint16
          +--ro statistics
             +--ro connection-opens?      yang:counter64
             +--ro connection-closes?     yang:counter64
             +--ro connection-aborts?     yang:counter64
             +--ro connection-failures?   yang:counter64
             +--ro connection-timeouts?   yang:counter64
             +--ro messages-sent?         yang:counter64
             +--ro messages-received?     yang:counter64
             +--ro errors-received?       yang:counter64
             +--ro sessions?              yang:counter64

]]></artwork>
      </figure>
]]></sourcecode>

    </section>
    <section title="TACACS+ numbered="true" toc="default">
      <name>TACACS+ Client Module"> Module</name>
      <t>This YANG module imports typedefs from <xref target="RFC6991"/>. target="RFC6991" format="default"/>. This
      module also uses the interface typedef from <xref target="RFC8343"/>, target="RFC8343" format="default"/>,
      the leafref to VRF instance from <xref target="RFC8529"/>, target="RFC8529" format="default"/>, and the
      "default-deny-all" extension statement from <xref
      target="RFC8341"/>.</t>

      <t>&lt;CODE BEGINS&gt; file
      "ietf-system-tacacs-plus@2021-05-13.yang"</t>

      <figure>
        <artwork><![CDATA[module target="RFC8341" format="default"/>.</t>

      <sourcecode name="ietf-system-tacacs-plus@2021-07-26.yang" type="yang" markers="true"><![CDATA[
module ietf-system-tacacs-plus {
  yang-version 1.1;
  namespace "urn:ietf:params:xml:ns:yang:ietf-system-tacacs-plus";
  prefix sys-tcs-plus;

  import ietf-inet-types {
    prefix inet;
    reference
      "RFC 6991: Common YANG Data Types";
  }
  import ietf-yang-types {
    prefix yang;
    reference
      "RFC 6991: Common YANG Data Types";
  }
  import ietf-network-instance {
    prefix ni;
    reference
      "RFC 8529: YANG Data Model for Network Instances";
  }
  import ietf-interfaces {
    prefix if;
    reference
      "RFC 8343: A YANG Data Model for Interface Management";
  }
  import ietf-system {
    prefix sys;
    reference
      "RFC 7317: A YANG Data Model for System Management";
  }
  import ietf-netconf-acm {
    prefix nacm;
    reference
      "RFC 8341: Network Configuration Access Control Model";
  }

  organization
    "IETF Opsawg OPSAWG (Operations and Management Area Working Group)";
  contact
    "WG Web:   <http://tools.ietf.org/wg/opsawg/>   <http://datatracker.ietf.org/wg/opsawg/>
     WG List:  <mailto:opsawg@ietf.org>

     Editor: Bo Wu <lana.wubo@huawei.com>
     Editor: Guangying Zheng <zhengguangying@huawei.com>";
  description
    "This module provides configuration of TACACS+ client.

     The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
     NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
     'MAY', and 'OPTIONAL' in this document are to be interpreted as
     described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
     they appear in all capitals, as shown here.

     Copyright (c) 2021 IETF Trust and the persons identified as
     authors of the code.  All rights reserved.

     Redistribution and use in source and binary forms, with or
     without modification, is permitted pursuant to, and subject
     to the license terms contained in, the Simplified BSD License
     set forth in Section 4.c of the IETF Trust's Legal Provisions
     Relating to IETF Documents
     (http://trustee.ietf.org/license-info).
     (https://trustee.ietf.org/license-info).

     This version of this YANG module is part of RFC XXXX; 9105; see the
     RFC itself for full legal notices.

     The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL', 'SHALL
     NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED', 'NOT RECOMMENDED',
     'MAY', and 'OPTIONAL' in this document are to be interpreted as
     described in BCP 14 (RFC 2119) (RFC 8174) when, and only when,
     they appear in all capitals, as shown here.";

  // RFC Ed.: update the date below with the date of RFC
  // publication and remove this note.
  // RFC Ed.: replace XXXX with actual RFC number and remove
  // this note. notices.";

  revision 2021-05-13 2021-07-26 {
    description
      "Initial revision.";
    reference
      "RFC XXXX: 9105: A YANG Module Data Model for TACACS+"; Terminal Access Controller
       Access-Control System Plus (TACACS+)";
  }

  typedef tacacs-plus-server-type {
    type bits {
      bit authentication {
        description
          "Indicates that the TACACS+ server is providing
           authentication services.";
      }
      bit authorization {
        description
          "Indicates that the TACACS+ server is providing
           authorization services.";
      }
      bit accounting {
        description
          "Indicates that the TACACS+ server is providing accounting
           services.";
      }
    }
    description
      "tacacs-plus-server-type can be set to
       authentication/authorization/accounting
       or any combination of the three types.";
  }

  identity tacacs-plus {
    base sys:authentication-method;
    description
      "Indicates AAA operation using TACACS+.";
    reference
      "RFC 8907: The TACACS+ Protocol";
  }

  grouping statistics {
    description
      "Grouping for TACACS+ statistics attributes"; attributes.";
    container statistics {
      config false;
      description
        "A collection of server-related statistics objects"; objects.";
      leaf connection-opens {
        type yang:counter64;
        description
          "Number of new connection requests sent to the server,
           e.g., socket open"; open.";
      }
      leaf connection-closes {
        type yang:counter64;
        description
          "Number of connection close requests sent to the server,
           e.g., socket close"; close.";
      }
      leaf connection-aborts {
        type yang:counter64;
        description
          "Number of aborted connections to the server.  These do
           not include connections that are closed gracefully.";
      }
      leaf connection-failures {
        type yang:counter64;
        description
          "Number of connection failures to the server"; server.";
      }
      leaf connection-timeouts {
        type yang:counter64;
        description
          "Number of connection timeouts to the server"; server.";
      }
      leaf messages-sent {
        type yang:counter64;
        description
          "Number of messages sent to the server"; server.";
      }
      leaf messages-received {
        type yang:counter64;
        description
          "Number of messages received from the server"; server.";
      }
      leaf errors-received {
        type yang:counter64;
        description
          "Number of error messages received from the server"; server.";
      }
      leaf sessions {
        type yang:counter64;
        description
          "Number of TACACS+ sessions completed with the server.
           If the Single Connection Mode was NOT enabled, the number
           of sessions is the same as the number of
           'connection-closes'.  If the Mode was enabled, a single
           TCP connection may contain multiple TACACS+ sessions.";
      }
    }
  }

  grouping tacacs-plus {
    description
      "Grouping for TACACS+ attributes"; attributes.";
    container tacacs-plus {
      must "not(derived-from-or-self(../sys:authentication"
         + "/sys:user-authentication-order, 'tacacs-plus'))"
         + " or bit-is-set(server/server-type,'authentication')" {
        error-message "When 'tacacs-plus' is used as a system"
                    + " authentication method, a TACACS+ authentication" TACACS+"
                    + " authentication server must be configured.";
        description
          "When 'tacacs-plus' is used as an authentication method,
           a TACACS+ server must be configured.";
      }
      description
        "Container for TACACS+ configurations and operations.";
      list server {
        key "name";
        ordered-by user;
        description
          "List of TACACS+ servers used by the device.";
        leaf name {
          type string;
          description
            "An arbitrary name for the TACACS+ server.";
        }
        leaf server-type {
          type tacacs-plus-server-type;
          mandatory true;
          description
            "Server type: authentication/authorization/accounting and
             various combinations.";
        }
        leaf address {
          type inet:host;
          mandatory true;
          description
            "The address of the TACACS+ server.";
        }
        leaf port {
          type inet:port-number;
          default "49";
          description
            "The port number of TACACS+ Server port.";
        }
        choice security {
          mandatory true;
          description
            "Security mechanism between TACACS+ client and server.
             This is modelled modeled as a YANG 'choice' so that it can be
             augmented by a YANG module in a backwards compatible backwards-compatible
             manner.";
          case obfuscation {
            leaf shared-secret {
              type string {
                length "1..max";
              }
              nacm:default-deny-all;
              description
                "The shared secret, which is known to both the
                 TACACS+ client and server.  TACACS+ server
                 administrators SHOULD configure a shared secret of with
                 a minimum length of 16 characters length. characters.
                 It is highly recommended that this shared secret is
                 at least 32 characters long and sufficiently complex
                 with a mix of different character types
                 i.e. types,
                 i.e., upper case, lower case, numeric, and
                 punctuation.  Note that this security mechanism is
                 best described as 'obfuscation' and not 'encryption'
                 as it does not provide any meaningful integrity,
                 privacy, or replay protection.";
              reference
                "RFC 8907: The TACACS+ Protocol";
            }
          }
        }
        choice source-type {
          description
            "The source address type for outbound TACACS+ packets.";
          case source-ip {
            leaf source-ip {
              type inet:ip-address;
              description
                "Specifies source IP address for TACACS+ outbound
                 packets.";
            }
          }
          case source-interface {
            leaf source-interface {
              type if:interface-ref;
              description
                "Specifies the interface from which the IP address
                 is derived for use as the source for the outbound
                 TACACS+
                 packet"; packet.";
            }
          }
        }
        leaf vrf-instance {
          type leafref {
            path "/ni:network-instances/ni:network-instance/ni:name";
          }
          description
            "Specifies the VPN Routing and Forwarding (VRF) instance
             to use to communicate with the TACACS+ server.";
          reference
            "RFC 8529: YANG Data Model for Network Instances";
        }
        leaf single-connection {
          type boolean;
          default "false";
          description
            "Whether
            "Indicates whether the single connection mode Single Connection Mode is enabled
             for the server.  By default, the single connection mode Single Connection Mode
             is disabled.";
        }
        leaf timeout {
          type uint16 {
            range "1..max";
          }
          units "seconds";
          default "5";
          description
            "The number of seconds the device will wait for a
             response from each TACACS+ server before trying with a
             different server.";
        }
        uses statistics;
      }
    }
  }

  augment "/sys:system" {
    description
      "Augment
      "Augments the system model with the tacacs-plus model"; model.";
    uses tacacs-plus;
  }
}

]]></artwork>
      </figure>

      <t>&lt;CODE ENDS&gt;</t>
]]></sourcecode>

    </section>
    <section title="Security Considerations"> numbered="true" toc="default">
      <name>Security Considerations</name>

      <t>The YANG module defined specified in this document defines a schema for data
      that is designed to be accessed via network management protocols such as
      NETCONF <xref
      target="RFC6241"/> target="RFC6241" format="default"/> or RESTCONF <xref target="RFC8040"/>.
      target="RFC8040" format="default"/>. The lowest NETCONF layer is the
      secure transport layer, and the mandatory-to-implement secure transport
      is Secure Shell (SSH) <xref
      target="RFC6242"/>. target="RFC6242" format="default"/>. The
      lowest RESTCONF layer is HTTPS, and the mandatory-to-implement secure
      transport is TLS <xref
      target="RFC8446"/>.</t> target="RFC8446" format="default"/>.</t>
      <t>The NETCONF access control model Network Configuration Access Control Model (NACM) <xref target="RFC8341"/>
      target="RFC8341" format="default"/> provides the means to restrict
      access for particular NETCONF or RESTCONF users to a preconfigured
      subset of all available NETCONF or RESTCONF protocol operations and
      content.</t>
      <t>There are a number of data nodes defined in this YANG module that are
      writable/creatable/deletable (i.e., config true, which is the default).
      These data nodes may be considered sensitive or vulnerable in some
      network environments. Write operations (e.g., edit-config) to these data
      nodes without proper protection can have a negative effect on network
      operations. These are the subtrees and data nodes and their
      sensitivity/vulnerability:</t>

      <t><list style="hanging">
          <t hangText="/system/tacacsplus/server:">This

      <dl newline="false" spacing="normal">
        <dt>/system/tacacs-plus/server:</dt>
        <dd>This list contains the data
          nodes used to control the TACACS+ servers used by the device.
          Unauthorized access to this list could enable an attacker to assume
          complete control over the device by pointing to a compromised
          TACACS+ server ,or server, or to modify the counters to hide attacks against
          the device.</t>

          <t hangText="/system/tacacsplus/server/shared-secret:">This device.</dd>
        <dt>/system/tacacs-plus/server/shared-secret:</dt>
        <dd>This leaf controls the key known to both the TACACS+ client and
        server.  Unauthorized access to this leaf could make the device
        vulnerable to
          attacks, therefore attacks; therefore, it has been restricted using the
        "default-deny-all" access control defined in <xref
          target="RFC8341"/>. target="RFC8341"
        format="default"/>. When setting, it is highly recommended that the
        leaf is at least 32 characters long and sufficiently complex with a
        mix of different character types i.e. types, i.e., upper case, lower case,
        numeric, punctuation.</t>
        </list></t> and punctuation.</dd>
      </dl>
      <t>This document describes the use of TACACS+ for purposes of
      authentication, authorization authorization, and accounting, accounting; it is vulnerable to all
      of the threats that are present in TACACS+ applications. For a
      discussion of such threats, see Section 10 of <xref target="RFC8907">the target="RFC8907"
      sectionFormat="of" section="10" format="default">the TACACS+
      Protocol</xref>.</t>

      <t/>
     protocol</xref>.</t>
    </section>
    <section title="IANA Considerations">
      <t>This document registers a numbered="true" toc="default">
      <name>IANA Considerations</name>
      <t>IANA has registered the following URI in the IETF XML registry <xref
      target="RFC3688"/>. Following "ns" subregistry within the format in "IETF XML Registry" <xref target="RFC3688"/>,
      the following registration is requested to be made:</t>

      <figure>
        <artwork><![CDATA[
   URI: urn:ietf:params:xml:ns:yang:ietf-system-tacacs-plus
   Registrant target="RFC3688" format="default"/>:</t>

<dl spacing="compact">
<dt>URI:</dt> <dd>urn:ietf:params:xml:ns:yang:ietf-system-tacacs-plus </dd>
<dt>Registrant Contact: The </dt> <dd>The IESG.
   XML: N/A,  </dd>
<dt>XML: </dt> <dd>N/A, the requested URI is an XML namespace.]]></artwork>
      </figure>

      <t>This document registers a namespace.  </dd>
</dl>

      <t>IANA has registered the following YANG module in the YANG "YANG Module Names Names"
      registry <xref target="RFC7950"/>.</t>

      <figure>
        <artwork><![CDATA[
     Name: ietf-system-tacacs-plus
     Namespace: urn:ietf:params:xml:ns:yang:ietf-system-tacacs-plus
     Prefix: sys-tcs-plus
     Reference: RFC XXXX (RFC Ed.: replace XXXX with actual
     RFC number and remove this note.)]]></artwork>
      </figure>
    </section>

    <section title="Acknowledgments">
      <t>The authors wish to thank Alex Campbell, John Heasley, Ebben Aries,
      Alan DeKok, Joe Clarke, Joe Clarke, Tom Petch, Robert Wilton, and many
      others for their helpful comments and suggestions.</t> target="RFC7950" format="default"/>:</t>

<dl spacing="compact">
<dt>Name: </dt> <dd>ietf-system-tacacs-plus </dd>
<dt>Maintained by IANA: </dt> <dd>N </dd>
<dt>Namespace: </dt> <dd>urn:ietf:params:xml:ns:yang:ietf-system-tacacs-plus </dd>
<dt>Prefix: </dt> <dd>sys-tcs-plus </dd>
<dt>Reference: </dt> <dd>RFC 9105 </dd>
</dl>

    </section>

  </middle>
  <back>
    <references title="Normative References">
      <?rfc include='reference.RFC.8907'?>

      <?rfc include='reference.RFC.2119'?>

      <?rfc include='reference.RFC.6241'?>

      <?rfc include='reference.RFC.6242'?>

      <?rfc include='reference.RFC.8340'?>

      <?rfc include='reference.RFC.7950'?>

      <?rfc include='reference.RFC.7317'?>

      <?rfc include='reference.RFC.8040'?>

      <?rfc include='reference.RFC.6991'?>

      <?rfc include='reference.RFC.8174'?>

      <?rfc include='reference.RFC.8341'?>

      <?rfc include='reference.RFC.8342'?>

      <?rfc include='reference.RFC.8446'?>

      <?rfc include='reference.RFC.8343'?>

      <?rfc include='reference.RFC.8529'?>
    <references>
      <name>References</name>
      <references>
        <name>Normative References</name>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8907.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.6241.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.6242.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8340.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.7950.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.7317.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8040.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.6991.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8174.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8341.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8342.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8446.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8343.xml"/>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.8529.xml"/>
      </references>
      <references>
        <name>Informative References</name>
        <xi:include href="https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.3688.xml"/>
      </references>

    <references title="Informative References">
      <?rfc include='reference.RFC.3688'?>
    </references>
    <section title="Example numbered="true" toc="default">
      <name>Example TACACS+ Authentication Configuration"> Configuration</name>
      <t>The following shows an example where a TACACS+ authentication server
      instance is configured.</t>

      <figure>
        <artwork><![CDATA[

      <sourcecode type=""><![CDATA[   {
     "ietf-system:system": {
       "authentication": {
         "user-authentication-order": [tacacs-plus, local-users]
       }
       "tacacs-plus": {
         "server": [
           {
             "name": "tac_plus1",
             "server-type": "authentication",
             "address": "192.0.2.2",
             "shared-secret": "QaEfThUkO198010075460923+h3TbE8n",
             "source-ip": "192.0.2.12",
             "timeout": "10"
           }
         ]
       }
     }
   }]]></artwork>
      </figure>
   }]]></sourcecode>
    </section>

    <section numbered="false" toc="default">
      <name>Acknowledgments</name>
      <t>The authors wish to thank <contact fullname="Alex Campbell"/>,
      <contact fullname="John Heasley"/>, <contact fullname="Ebben Aries"/>,
      <contact fullname="Alan DeKok"/>, <contact fullname="Joe Clarke"/>,
      <contact fullname="Tom Petch"/>, <contact fullname="Robert Wilton"/>,
      and many others for their helpful comments and suggestions.</t>
    </section>

  </back>
</rfc>