{
  "port": 49,
  "protocol": "tcp",
  "service": "TACACS+",
  "oneLiner": "TACACS+ — the AAA protocol network gear uses to authenticate and authorise every command an admin types.",
  "whatItIs": "IANA registers 49 as the Login Host Protocol (TACACS); the protocol actually deployed on it is TACACS+, specified in RFC 8907, which routers, switches and firewalls use to check administrator logins, authorise individual commands, and log accounting records against a central server. Unlike RADIUS it separates authentication, authorisation and accounting and can gate per-command execution, which is why enterprise network teams standardise on it. Its body obfuscation is an MD5-based keyed scheme, not real cryptography, so RFC 8907 states it must run over a secured transport or a trusted network. A listener on 49 means a TACACS+ server such as tac_plus.",
  "exposure": {
    "verdict": "never",
    "note": "This is the authentication and authorisation plane for network infrastructure, protected by a shared secret and weak obfuscation; it belongs on a management network only."
  },
  "checkCommand": "nc -vz TARGET 49",
  "links": [
    {
      "title": "RFC 8907 — The Terminal Access Controller Access-Control System Plus (TACACS+) Protocol",
      "url": "https://www.rfc-editor.org/rfc/rfc8907.html",
      "kind": "spec"
    },
    {
      "title": "RFC 1492 — An Access Control Protocol, Sometimes Called TACACS",
      "url": "https://www.rfc-editor.org/rfc/rfc1492.html",
      "kind": "spec"
    },
    {
      "title": "event-driven-servers (tac_plus / tac_plus-ng) source repository",
      "url": "https://github.com/MarcJHuber/event-driven-servers",
      "kind": "github"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}