Content
# TACACS-NG-UI
<div align="center">
🌐 **Language / Ngôn ngữ:** [🇬🇧 English](./README.md) | [🇻🇳 Tiếng Việt](./README.vi.md)
</div>
---
<p align="center">
<img src="img/dashboard.png" alt="TACACS-NG-UI Dashboard" width="800px" style="border-radius: 8px; box-shadow: 0 4px 20px rgba(0,0,0,0.15);" />
</p>
<div align="center">
[](https://fastapi.tiangolo.com)
[](https://react.dev)
[](https://chakra-ui.com)
[](https://www.docker.com)
[](https://opensource.org/licenses/MIT)
</div>
---
> [!IMPORTANT]
> ### ⚠️ Upgrading to 0.6.0 — every URL changes
>
> The dashboard, the API, Swagger and the MCP endpoint now share **one URL**.
> `dashboard.<domain>` and `api.<domain>` no longer route.
>
> - `VITE_API_URL` must be **empty**, and the frontend image **must be rebuilt** — it is baked in at build time.
> - `FRONTEND_HOST` must name the single URL; it drives CORS, passkeys, OAuth and email links.
> - **Existing passkeys break if you change the host.** Keep them by setting `DOMAIN` to your current dashboard host.
> - OAuth redirect URIs must be re-registered with Google / Keycloak.
> - MCP clients must be re-pointed to `https://<domain>/mcp/`; existing API keys stay valid.
>
> Full checklist: [Upgrading to 0.6.0](docs/en/deployment.md#upgrading-to-060).
---
### What is TACACS-NG-UI?
**tacacs-ng-ui** is a next-generation full-stack web application designed to simplify the administration and management of [tac_plus-ng](https://github.com/MarcJHuber/event-driven-servers), the modern event-driven TACACS+ daemon.
Historically, managing TACACS+ servers required manually editing complex configuration files, leading to human errors, auditing challenges, and security loopholes. **tacacs-ng-ui** bridges this gap by providing:
1. **Dynamic Web Management**: Manage TACACS+ users, groups, profiles, hosts, and authorization policies through a responsive, premium UI built with React and Chakra UI.
2. **Versioned Config Engine**: Compile and validate configuration snapshots directly from the UI. Features side-by-side diff comparisons, error syntax checking, and safe version rollbacks.
3. **Observability & Log Auditing**: Monitor authentication, authorization, and accounting (AAA) stats in real-time, complete with a timeline view of auditing logs and user command histories.
4. **Automated Threat Alerting**: Real-time alert rule evaluations paired with Machine Learning (IsolationForest) anomaly detection to secure infrastructure against abnormal activities.
## Table of Contents
- [Key Features](#key-features)
- [Live Demo](#live-demo)
- [Device Configuration Examples](#device-configuration-examples)
- [Tested Devices (GitHub Discussions)](https://github.com/thangphan205/tacacs-ng-ui/discussions/185)
- [Juniper Config (Junos)](docs/en/config-examples/juniper.md)
- [Cisco Config (IOS/XE)](docs/en/config-examples/cisco.md)
- [Huawei Config - Virtual CE12800 (VRP)](docs/en/config-examples/huawei.md)
- [Huawei Config - Physical Campus S-Series (VRP)](docs/en/config-examples/huawei-physical.md)
- [Technology Stack](#technology-stack-and-features)
- [How To Use It](#how-to-use-it)
- Deployment
- [Deploy on localhost](#deploy-on-a-localhost)
- [Deploy on remote server](#deploy-on-a-remote-server)
- [Deploy with domain name](#deploy-on-a-remote-server-with-domain-name)
- [Configuration](#configuration)
- [Generate Secret Keys](#generate-secret-keys)
- [Google OAuth](#google-oauth-optional)
- [High Availability (HA)](#high-availability-ha-deployment)
- [MCP Server](#mcp-server)
- [User Guide](#user-guide)
- [Development](#backend-development)
- [Screenshots](#screenshots)
- [Implemented Features](#implemented-features)
- [Release Notes](#release-notes)
- [License](#license)
---
## Key Features
- **Intuitive Web Interface**: Manage TACACS+ users, groups, and policies through a clean and responsive UI built with React and Chakra UI. Every management table has a unified premium layout with live search, sort, and pagination.
- **TACACS+ Server**: Utilizes [tac_plus-ng](https://github.com/MarcJHuber/event-driven-servers) as the backend TACACS+ server, a modern and actively maintained implementation.
- **Versioned Config Management**: Generate, preview, and activate TACACS+ configuration snapshots — each version is stored, can be rolled back, and compared with a built-in diff viewer. Supports inline editing of the config file directly in the browser.
- **Multi-Vendor Seed Data**: First startup automatically creates ready-to-use groups (`tacacs_super_user`, `tacacs_read_only`), users (`user_admin`, `user_read_only`), and authorization profiles covering **Cisco, Arista, Huawei (VRP + H3C), Juniper, Palo Alto, and Fortinet** — no manual setup required to test with real devices.
- **Interactive Field Guides**: Every Add/Edit dialog includes a contextual Field Guide panel explaining each field, accepted values, and examples — no need to consult external docs while configuring.
- **Observability Dashboard**: Today's log summary (auth/authz/acct counts), config entity overview cards, recent user activity, and Top 5 & trend charts with Last 7 Days / Last 30 Days / Date Range filter.
- **Structured Log Events Viewer**: Browse TACACS+ log events with date picker, type/result/username filters, clickable username drill-down, command column with tooltips, port/TTY column, and a detail drawer with interactive session timeline for auditing full command sequences.
- **SIEM Integration**: Forward TACACS+ log events in real-time via HTTP webhook (Splunk HEC format) and/or syslog (UDP/TCP).
- **Global Search**: Every management table (Hosts, Users, Groups, Profiles, Rulesets, and more) has a live search box with debounced, case-insensitive, server-side filtering.
- **Comprehensive Audit Logging**: Every UI action is recorded with actor, IP, entity snapshot (before/after), and timestamp. Superuser-only table with search, date-range filter, and CSV export.
- **Real-Time Alert Rules**: Define rules (auth failure spikes, new usernames/IPs, repeated rejects from a single source IP, config changes, activations) with configurable windows, thresholds, cooldowns, and severity. Notifications dispatched via Telegram, Slack, Discord, Teams, Google Chat, Email, or generic webhook — evaluated every 5 minutes from live log files, no daily cron dependency. Webhook channels also receive the alert as structured JSON (`data.ip`, `data.fail_count`, `data.triggered_ips`) so downstream automation can act on it without parsing text.
- **ML Anomaly Detection**: IsolationForest model scores every user daily across four behavioral features (avg/stddev auth failures, unique IPs, deny ratio). Results classified normal/low/medium/high/critical and displayed in a dedicated UI page.
- **High Availability**: Run one primary with N standby nodes. Config changes fan out to every enabled peer, standbys follow via PostgreSQL streaming replication, and peers are added, disabled, or removed from the HA UI without restarting a service. Promotion to primary is a single click.
- **MCP Server for LLM Clients**: A [Model Context Protocol](https://modelcontextprotocol.io) endpoint lets Claude Desktop, Claude Code, Antigravity, Gemini, Cursor or Windsurf inspect TACACS+ entities, render config previews and diffs, and syntax-check config text with the real `tac_plus-ng -P` parser — and, with a read-write key, create, update and delete entities. **It can never deploy**: no tool saves a config file, activates one, or reloads the daemon, so changes reach the daemon only after a human presses Generate and Activate in the UI. On by default (can be turned off), authenticated with scoped and revocable API keys, and secrets are redacted from every response.
- **Scoped API Keys**: Machine credentials managed under User Settings. Two access levels (read-only or read-write), an independent opt-in for unredacted secrets, expiry, one-time plaintext display, soft revoke, and full audit logging. Each key can also be locked to an allowlist of source IPs/CIDRs, editable at any time without reissuing the key.
- **Multi-Factor Auth**: Google OAuth, Keycloak OIDC, Microsoft (personal accounts and Entra ID), and Passkeys (WebAuthn) in addition to email/password.
- **Secure by Design**: PCI DSS-compliant password policy, JWT authentication, and email-based password recovery.
- **Integrated Tooling**: Traefik reverse proxy, automatic API documentation via Swagger UI, and end-to-end testing with Playwright.
## Live Demo
Video Demo: [English - Demo tacacs-ng-ui - Setup for Juniper Devices](https://youtu.be/MUGusXOFJBI)
Video Tiếng Việt:[tacacs-ng-ui - Demo - Cấu hình chứng thực tập trung với thiết bị Juniper](https://youtu.be/vnuZMcHxpH4)
Telegram Group: <https://t.me/+v1eAXg-BhotlODY1>
Reddit Community: <https://www.reddit.com/r/tacacs_ng_ui/>
You can sign up and use this tacacs server to test with your simulator lab.
- **Dashboard:** <https://tacacs.9ping.cloud>
- **IP TACACS Server:** Ping tacacs.9ping.cloud to get IP TACACS Server.
```bash
ping tacacs.9ping.cloud
```
- **TACACS key:** `change_this`
**Demo Credentials:**
- **Admin User**
- **Username:** `user_admin`
- **Password:** `change_this`
- **Read-Only User**
- **Username:** `user_read_only`
- **Password:** `change_this`
## Device Configuration Examples
> [!TIP]
> **Tested Devices**: Looking for a list of compatible devices tested by the community or want to report a device you've tested? Visit our [GitHub Discussions Compatibility List](https://github.com/thangphan205/tacacs-ng-ui/discussions/185).
Below are quick configuration examples for common network vendors. For detailed step-by-step integration guides including user/group mapping, AAA schemes, and full reference configuration dumps, see:
* **Juniper Junos**: [docs/en/config-examples/juniper.md](docs/en/config-examples/juniper.md)
* **Cisco IOS/XE**: [docs/en/config-examples/cisco.md](docs/en/config-examples/cisco.md)
* **Huawei VRP (Virtual / CloudEngine)**: [docs/en/config-examples/huawei.md](docs/en/config-examples/huawei.md)
* **Huawei VRP (Physical Campus S-Series)**: [docs/en/config-examples/huawei-physical.md](docs/en/config-examples/huawei-physical.md)
---
## Juniper Config
<details>
<summary>Show Config Commands</summary>
```bash
# Example Juniper configuration for TACACS+
# 1. Define local user classes for TACACS+ users
set system login class read-only-local idle-timeout 15
set system login class read-only-local permissions view
set system login class read-only-local permissions view-configuration
set system login class super-user-local idle-timeout 15
set system login class super-user-local permissions all
set system login user tacacs_read_only uid 2001
set system login user tacacs_read_only class read-only-local
set system login user tacacs_super_user uid 2002
set system login user tacacs_super_user class super-user-local
# 2. Set authentication order to check TACACS+ first, then local password
set system authentication-order tacplus
set system authentication-order password
# 3. Configure the TACACS+ server details
set system tacplus-server <IP_TACACS_SERVER> port 49
set system tacplus-server <IP_TACACS_SERVER> secret <TACACS_SECRET_KEY>
set system tacplus-server <IP_TACACS_SERVER> source-address <DEVICE_SOURCE_IP>
# 4. Configure accounting to send logs to the TACACS+ server
set system accounting events login
set system accounting events change-log
set system accounting events interactive-commands
set system accounting destination tacplus server <IP_TACACS_SERVER> secret <TACACS_SECRET_KEY>
set system accounting destination tacplus server <IP_TACACS_SERVER> source-address <DEVICE_SOURCE_IP>
```
</details>
## Cisco Config
<details>
<summary>Show Config Commands</summary>
```bash
# 1. Enable AAA (Authentication, Authorization, and Accounting)
aaa new-model
# 2. Define the TACACS+ server
tacacs server TACACS-9PING
# IP address of your TACACS-NG-UI server
address ipv4 <IP_TACACS_SERVER>
# Shared secret key, must match the server configuration
key <TACACS_SECRET_KEY>
exit
# 3. Create a server group (best practice for redundancy)
aaa group server tacacs+ TACACS-GROUP
server name TACACS-9PING
# Optional to use vrf forwarding
# ip vrf forwarding clab-mgmt
exit
# 4. Configure Authentication, Authorization, and Accounting methods
# Use TACACS+ first, then fall back to the local database if the server is unreachable
aaa authentication login default group TACACS-GROUP local
aaa authorization exec default group TACACS-GROUP local
aaa accounting exec default start-stop group TACACS-GROUP
# Log all commands run in privileged (enable) mode
aaa accounting commands 15 default start-stop group TACACS-GROUP
# 5. Apply the authentication method to VTY lines (for SSH/Telnet)
line vty 0 4
login authentication default
exit
```
</details>
## Arista Config
<details>
<summary>Show Config Commands</summary>
```bash
# 1. Define the TACACS+ server and shared key
# 'key 0' specifies the key is in clear text. For production, use an encrypted key.
tacacs-server host <IP_TACACS_SERVER> key 0 <TACACS_SECRET_KEY>
!
# 2. Create a server group for TACACS+ (best practice)
aaa group server tacacs+ TACACS_GROUP
# Add the server to the group
server <IP_TACACS_SERVER>
!
# 3. Configure Authentication, Authorization, and Accounting methods
# Use the TACACS+ group first, then fall back to the local database if unreachable.
aaa authentication login default group TACACS_GROUP local
aaa authorization exec default group TACACS_GROUP local
# Authorize all commands against the TACACS+ server for granular control.
aaa authorization commands all default group TACACS_GROUP local
# Log the start and stop of exec sessions for auditing.
aaa accounting exec default start-stop group TACACS_GROUP
# 4. (Optional) Specify the source interface for TACACS+ traffic.
ip tacacs source-interface Management0
```
</details>
## Technology Stack and Features
- ⚡ [**FastAPI**](https://fastapi.tiangolo.com) for the Python backend API.
- 🧰 [SQLModel](https://sqlmodel.tiangolo.com) for the Python SQL database interactions (ORM).
- 🔍 [Pydantic](https://docs.pydantic.dev), used by FastAPI, for the data validation and settings management.
- 💾 [PostgreSQL](https://www.postgresql.org) as the SQL database.
- 🚀 [React](https://react.dev) for the frontend.
- 💃 Using TypeScript, hooks, Vite, and other parts of a modern frontend stack.
- 🎨 [Chakra UI](https://chakra-ui.com) for the frontend components.
- 🤖 An automatically generated frontend client.
- 🧪 [Playwright](https://playwright.dev) for End-to-End testing.
- 🦇 Dark mode support.
- 🐋 [Docker Compose](https://www.docker.com) for development and production.
- 🔒 Secure password hashing by default.
- 🔑 JWT (JSON Web Token) authentication.
- 📫 Email based password recovery.
- ✅ Tests with [Pytest](https://pytest.org).
- 📞 [Traefik](https://traefik.io) as a reverse proxy / load balancer.
- 🚢 Deployment instructions using Docker Compose, including how to set up a frontend Traefik proxy to handle automatic HTTPS certificates.
- 🏭 CI (continuous integration) and CD (continuous deployment) based on GitHub Actions.
## How To Use It
For a full walkthrough of all features, see the **[User Guide](docs/en/user-guide.md)** (bilingual English / Tiếng Việt).
## Deploy on a localhost
```bash
git clone https://github.com/thangphan205/tacacs-ng-ui
cd tacacs-ng-ui
cp .env.example .env # then edit .env and set your own secrets
docker compose up -d
```
Access: <http://localhost:5173> with the credentials you set in `.env`:
```bash
Username: admin@example.com # FIRST_SUPERUSER in .env
Password: <FIRST_SUPERUSER_PASSWORD in .env>
```
Development URLs, for local development. The frontend proxies `/api`, `/mcp`,
`/docs` and `/redoc` to the backend, so everything the app needs is on one
origin — port 8000 stays published for direct backend access.
Frontend (and API, Swagger, MCP): <http://localhost:5173>
Automatic Interactive Docs (Swagger UI): <http://localhost:5173/docs>
Automatic Alternative Docs (ReDoc): <http://localhost:5173/redoc>
MCP endpoint: <http://localhost:5173/mcp/>
Backend, direct: <http://localhost:8000>
Adminer: <http://localhost:8080>
Traefik UI: <http://localhost:8090>
MailCatcher: <http://localhost:1080>
## Deploy on a remote server
For example, deploying on server `192.168.8.8`. Only `.env` needs to change — no edits to any compose file.
```bash
git clone https://github.com/thangphan205/tacacs-ng-ui
cd tacacs-ng-ui
cp .env.example .env
```
Edit `.env` — change these 3 values:
```bash
DOMAIN=192.168.8.8
FRONTEND_HOST=http://192.168.8.8:5173
SECRET_KEY=<run: openssl rand -hex 32>
```
`VITE_API_URL` stays empty: the UI calls its own origin and the frontend
proxies through to the backend, so one URL serves everything.
Then build and start:
```bash
docker compose build
docker compose up -d
```
Access — the UI, the API, Swagger (`/docs`) and MCP (`/mcp/`) all live under
<http://192.168.8.8:5173>, with the credentials set in `.env`:
```bash
Username: admin@example.com # FIRST_SUPERUSER in .env
Password: <FIRST_SUPERUSER_PASSWORD in .env>
```
> **Note:** `FRONTEND_HOST` drives the CORS allow-list, the WebAuthn/passkey origin, the OAuth redirect and the links in outgoing emails — it must match what the browser shows, port included. `BACKEND_CORS_ORIGINS` needs no edit.
## Deploy on a remote server: with domain name
Point DNS at the server, then run the bootstrap script from the repository root:
```bash
git clone https://github.com/thangphan205/tacacs-ng-ui
cd tacacs-ng-ui
bash setup.sh
```
It writes `.env` with generated secrets, starts Traefik with HTTPS and Let's
Encrypt, builds the images, runs the migrations, and prints the admin password
once at the end. `bash setup.sh --help` lists the flags.
For the manual steps, HA, upgrades and the environment variable reference, see
[docs/en/deployment.md](docs/en/deployment.md).
## Configuration
Before deploying, change at least these values in `.env`:
- `SECRET_KEY`
- `FIRST_SUPERUSER_PASSWORD`
- `POSTGRES_PASSWORD`
Pass these as environment variables from secrets. See [docs/en/deployment.md](docs/en/deployment.md) for details.
### Generate Secret Keys
Some environment variables in the `.env` file have a default value of `changethis`.
To generate a secure key:
```bash
python3 -c "import secrets; print(secrets.token_urlsafe(32))"
```
Run again to generate another key.
### Google OAuth (optional)
To enable "Sign in with Google", create OAuth credentials in [Google Cloud Console](https://console.cloud.google.com/) → APIs & Services → Credentials → OAuth 2.0 Client ID, then add to `.env`:
```bash
GOOGLE_CLIENT_ID=your-client-id.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=your-client-secret
GOOGLE_REDIRECT_URI=http://<your-host>:8000/api/v1/oauth/google/callback
```
Also add `GOOGLE_REDIRECT_URI` as an **Authorized Redirect URI** in Google Console. If Google OAuth is not configured, the "Sign in with Google" button shows an error and email/password login continues to work normally.
## High Availability (HA) Deployment
tacacs-ng-ui supports three HA deployment models:
| Model | Description |
|-------|-------------|
| **A — Independent** | Two fully separate stacks — no sync, each zone managed independently |
| **B — Primary–Standby** | Zone B replicates from Zone A via PostgreSQL streaming replication; config syncs automatically or on-demand |
| **C — Multi-Node** | One primary + N standbys; config fan-out to all peers; peers managed via UI without restart |
<p align="center">
<img src="img/high-availability-model-a.svg" alt="Model A — Independent" width="49%" />
<img src="img/high-availability-model-b.svg" alt="Model B — Primary–Standby" width="49%" />
</p>
All models support per-zone LDAP server configuration via `MAVIS_OVERRIDE_*` env vars.
**Full guide:** [docs/en/high-availability.md](docs/en/high-availability.md)
## MCP Server
A [Model Context Protocol](https://modelcontextprotocol.io) endpoint lets an LLM client (Claude Desktop, Claude Code, Antigravity, Gemini, Cursor, Windsurf) inspect TACACS+ entities, render config previews and diffs, and syntax-check config text with the real `tac_plus-ng -P` parser. On by default (`MCP_ENABLED=true`; set to `false` to disable); authenticated with dedicated, revocable API keys, with secrets redacted from all output.
Keys are issued at one of two access levels:
| Level | What the client can do |
|---|---|
| **Read-only** | Inspect entities and settings, render previews, diffs and sections, syntax-check config. Changes nothing. |
| **Read-write** | The above, plus creating, updating and deleting TACACS+ entities. Requires the key to belong to a superuser. |
**Neither level can deploy.** There is no tool that saves a config file, activates one, or reloads tac_plus-ng. An entity edited over MCP sits in the database until a human opens **TACACS Configs** and presses *Generate*, then *Activate* — and that page now flags when the database has drifted from the running config, so a pending change is visible rather than silent.
**Full guide:** [docs/en/mcp-server.md](docs/en/mcp-server.md)
## User Guide
Full usage guide (managing users, hosts, profiles, rulesets, generating configs, monitoring): [docs/en/user-guide.md](docs/en/user-guide.md).
## Backend Development
Backend docs: [backend/README.md](./backend/README.md).
## Frontend Development
Frontend docs: [frontend/README.md](./frontend/README.md).
## Deployment
Deployment docs: [docs/en/deployment.md](docs/en/deployment.md).
## Development
General development docs: [docs/en/development.md](docs/en/development.md).
This includes using Docker Compose, custom local domains, `.env` configurations, etc.
## Screenshots
### Dashboard
[](https://github.com/thangphan205/tacacs-ng-ui)
### TACACS+ Config Generator
[](https://github.com/thangphan205/tacacs-ng-ui)
### Active Tacacs Config
[](https://github.com/thangphan205/tacacs-ng-ui)
### Log Events Viewer
[](https://github.com/thangphan205/tacacs-ng-ui)
### AAA Statistics
[](https://github.com/thangphan205/tacacs-ng-ui)
### Users Management
[](https://github.com/thangphan205/tacacs-ng-ui)
### Groups
[](https://github.com/thangphan205/tacacs-ng-ui)
### Profiles
[](https://github.com/thangphan205/tacacs-ng-ui)
### Rulesets
[](https://github.com/thangphan205/tacacs-ng-ui)
### Hosts
[](https://github.com/thangphan205/tacacs-ng-ui)
### Services
[](https://github.com/thangphan205/tacacs-ng-ui)
### Mavis (LDAP/AD Backend)
[](https://github.com/thangphan205/tacacs-ng-ui)
### TACACS+ NG Settings
[](https://github.com/thangphan205/tacacs-ng-ui)
### Audit Logs
[](https://github.com/thangphan205/tacacs-ng-ui)
### Auth Providers
[](https://github.com/thangphan205/tacacs-ng-ui)
### Configuration Options
[](https://github.com/thangphan205/tacacs-ng-ui)
### Docs API
[](https://github.com/thangphan205/tacacs-ng-ui)
### Traefik
[](https://github.com/thangphan205/tacacs-ng-ui)
### Adminer
[](https://github.com/thangphan205/tacacs-ng-ui)
## Implemented Features
To further enhance the security and utility of tacacs-ng-ui, the following roadmap has been established:
1. **Modernized Authentication Framework**: ✅ Google OAuth (Authorization Code flow), ✅ Keycloak OIDC, and ✅ Passkeys (WebAuthn) for passwordless login are all supported as of v0.2.0; ✅ Microsoft / Entra ID sign-in was added in v0.6.1.
2. **Comprehensive Frontend Audit Logging**: ✅ Every UI action (create/update/delete/login/config-apply) is recorded with actor, IP, entity snapshot, and timestamp as of v0.2.1. Includes CSV export, search, and date-range filter.
3. **Advanced Observability Dashboard**: ✅ Today's log summary, config overview cards, recent user activity, Top 5 pie charts (users/IPs) with Last 7 Days / Last 30 Days / Date Range filter, and AAA trend line chart — all shipped in v0.3.0. Structured TACACS log events viewer with date/type/result/username filters added in v0.3.0. Enhanced in v0.3.2 with clickable username drill-down, command/port columns, row-click detail drawer, and session timeline for auditing full command sequences.
4. **SIEM Integration**: ✅ Real-time forwarding of TACACS+ log events via HTTP webhook (Splunk HEC format) and syslog (UDP/TCP) shipped in v0.3.0.
5. **Proactive Abnormal Access Detection & Alerting**: ✅ Real-time alert rules engine with multi-channel notifications (Telegram, Slack, Discord, Teams, Google Chat, Email/SMTP, webhook) and ML-based anomaly detection (IsolationForest) shipped in v0.3.5–v0.3.6. Alerts evaluated every 5 minutes from live log files with configurable windows, thresholds, cooldowns, and severity levels. Rich per-channel formatting with severity emojis and structured layouts added in v0.3.6. Extended in v0.5.3 with per-source-IP thresholds (alert when one IP crosses N auth rejects in the window) and a structured `data` object on webhook payloads for downstream automation.
6. **Improved UX / Zero-Config Start**: ✅ Shipped in v0.4.0 — interactive Field Guide panels in every Add/Edit dialog, premium UI redesign across all management tables, multi-vendor seed data (Cisco, Arista, Huawei, Juniper, Palo Alto, Fortinet) pre-loaded on first startup, inline TACACS+ config file editing, command tooltips and interactive event selection in session timeline, and unified 24-hour datetime formatting.
7. **High Availability**: ✅ Shipped in v0.5.0 — Model C multi-node HA (one primary + N standbys) with config fan-out to every enabled peer and per-peer sync state tracking. All HA settings except `NODE_ROLE` and `INTERNAL_SYNC_TOKEN` live in the database and are editable from the UI without a restart, and promoting a standby writes its scheduler state directly. Hardened in v0.5.1 with standby failover peer seeding, a read-only-safe standby dashboard, and a unified `setup-ha.sh` deployment script.
8. **LLM-Assisted Administration**: ✅ Shipped in v0.6.0 — an MCP server exposing fifteen tools, a tac_plus-ng syntax reference resource, an entity schema resource, and an authoring prompt, so an LLM client can inspect entities, preview and diff configs, syntax-check candidate config text against the real parser, and — with a read-write key — create, update and delete entities. Backed by scoped, revocable API keys with secret redaction on every response. Deploying a config (saving, activating, reloading the daemon) is deliberately and permanently out of scope, enforced by a guard test rather than convention.
## Release Notes
Check the file [docs/en/release-notes.md](docs/en/release-notes.md).
## License
This project is licensed under the terms of the MIT license.
Source code: <https://github.com/thangphan205/tacacs-ng-ui>
Connection Info
You Might Also Like
No recommendations available