Skip to content
TARANAC

1.3.3 — Every bolt thrown

← Blog

Versions2026-10-18

1.3.3 — Every bolt thrown

A good door lock is not one bolt. One key turns one cylinder, and a rod throws bolts at several points along the door, so it is only as easy to open as its weakest point. 1.3.3 is that kind of release: a security review that went round the whole door and threw a bolt wherever one was missing.

  • Sessions — signing out and the idle timeout end the session on the server; a copied session token is no longer good for days.
  • RADIUS — a device is the address its request comes from, not what it writes into NAS-IP-Address.
  • EAP-TLS — the user comes from the certificate alone, and a directory user must belong to that directory.
  • TACACS+ — the daemon is built from a pinned, tested fork, and a command set can no longer write its own rules into the configuration.
  • EST, captive portal, collectors, MFA — each one stops trusting what its client says about itself.
  • Secrets — join tokens and the master key never go on the command line.

It also makes TACACS+ over TLS and EST renewal work out of the box, and a cluster renews its etcd certificates — and replaces its etcd CA — by itself.

Because this is a security release, some changes need action on your side when you update. They are listed first.

What’s in 1.3.3

Before you update

Security: every bolt

New

Fixes worth knowing

What to do when updating

Read this list before you run ./taranac update. Most items are a single line of work; skipping them is what hurts.

Everyone

  • RADIUS devices that send from another address. The device is now the source address of the request. A device whose NAS-IP-Address pointed at a different device record than its source address now matches the record for its source address — check the policy rules of those devices. Devices behind one NAT address are one device for RADIUS.
  • EAP-TLS with OpenLDAP or FreeIPA. Fill in the LDAP configuration’s domain suffix, or EAP-TLS matches those users by email only.
  • Automation that passes secrets as arguments. collector-join.sh --enrollment-token, portal-join.sh --token and ./taranac restore --master-key are refused. Use the --…-file options, stdin (-) or the environment variables (TARANAC_ENROLLMENT_TOKEN, TARANAC_PORTAL_TOKEN, TARANAC_MASTER_KEY).
  • MFA. TARANAC_MFA_API_KEY must be at least 32 characters. If it is missing, the update generates one — enter the same key under Settings → MFA, or push MFA stops. A standalone MFA service behind your own reverse proxy must list it in TARANAC_MFA_TRUSTED_PROXIES.
  • Telegram MFA. The api log used to contain the bot token. If your logs were shared or forwarded, revoke the token in @BotFather and set the new one.
  • Email and SMS templates are checked by a sandbox. A template the sandbox rejects fails to send until you correct it.
  • TACACS+ command sets whose command uses characters other than letters, digits, _ . : - and single spaces, or whose pattern is not a one-line regular expression, must be corrected the next time they are saved.
  • A customised password prompt that mentions the OTP: users under an MFA rule now see the separate MFA password prompt — set that one too, or leave it empty (see below for when to leave it empty).
  • LDAP servers that cap paged searches (OpenLDAP defaults to 500) now make the sync fail with a clear error instead of syncing a truncated list. Raise the limit for the bind account.
  • EST. First enrollment is by password only; a client certificate only renews a certificate this Taranac issued. Devices renew on the EST gateway port 8445 — open it in the firewall. The gateway presents its own certificate, signed by the Infrastructure CA; devices that trusted it through the NAC certificate must trust the Infrastructure CA instead.
  • TACACS+ over TLS (6049) accepts clients and by default trusts every enabled internal CA — including the ones that issue EAP-TLS certificates. To narrow it, set TACACS+ Settings → TLS Client Trust to Selected CAs.
  • Sponsor approval links sent before the update no longer work.

Clusters

  • Update every member to 1.3.3, the witness included — replicas, then the leader, the witness last. Each member runs a new etcd-agent container that renews its etcd certificate. An air-gapped witness sets ETCD_AGENT_IMAGE_PREFIX to its mirror.
  • After the update the witness holds the cluster’s etcd CA key (config/etcd-ca, 0600): protect the witness like a database node.

Remote parts

  • Collectors must run 1.3.3 to get NCM work; until then the core shows a Requires update badge and an alert. Update them after the core: ./collector-join.sh --update.
  • Standalone captive portals must be updated (./taranac captive-portal update or ./portal-join.sh --update), or the core no longer learns the guest’s address.

Web sessions end on the server

Signing out — from the user menu or by the idle timeout — now ends the session on the server. Before, the browser only forgot it, and a copied session token stayed usable for up to seven days.

The idle timeout holds when the browser is closed. The server refuses to extend a session that has been idle past Authentication → Idle Timeout, so a laptop opened the next morning lands on the login page. A new Maximum Session Length ends every web session a set number of hours after login, active or not (off by default).

Around that:

  • Rate limits on login, MFA and guest registration count each client, not the proxy in front — a handful of requests from anyone no longer locks everyone out.
  • Push and email MFA challenges are limited: at most five per sign-in, twenty seconds apart.
  • Password hashing runs off the request loop, so a burst of login attempts no longer freezes the API.
  • The api log no longer contains the Telegram bot token (it was in every logged request URL).

RADIUS knows a device by where the request comes from

NAS-IP-Address is written by the sender. RADIUS AAA used it to decide which device a request came from, so any device holding a valid shared secret could name another device’s address and be matched by that device’s rules — and dodge a per-device brute-force ban by changing it on every request.

The device is now the address the request comes from, the one its shared secret is bound to — the way TACACS+ always worked. NAS-IP-Address decides nothing and stays in the raw request of the log entry.

A welcome side effect: devices that send no NAS-IP-Address at all (Calix CMS/SMx, in-house tools) used to end in “No matching policy” after a correct password. They now match like any other device. The NAS IP column of the RADIUS logs shows the source address, and the Policy Tester asks for a Device IP.

EAP-TLS: the certificate names the user

The user was taken from the client-supplied User-Name when the certificate named nobody, and a certificate’s domain was dropped unchecked — so a certificate for one directory could sign in as a same-named user of another.

Now the user comes from the certificate alone: its UPN, then its email, then its CN. A certificate that names none of them (a machine certificate with only a DNS name) is a machine session with no user, whatever the client wrote. A directory account matches only if the certificate carries the account’s own email, or a UPN/CN in the LDAP configuration’s domain suffix; a certificate from the wrong domain is rejected before policy, with the reason in the NAC authentication log.

TACACS+: a pinned daemon and sealed command sets

  • tac_plus-ng is built from a pinned, tested revision of the TaranacLabs fork of event-driven-servers, instead of whatever upstream master held at build time. It brings upstream fixes that matter: on a device with single-connection, a session could receive the authorization verdict of an earlier session on that connection; an MS-CHAP login could crash a daemon worker; and a configuration that crashes the parser could pass validation.
  • A command set cannot alter the configuration. Its command and pattern were written into the daemon’s configuration as stored, so a crafted value could add its own rule. Both are now encoded, the command is matched literally, and the form accepts only CLI words and a one-line regular expression.
  • A policy change cannot briefly hand a user another rule’s privilege level. Rules were tied to their profiles by position, so right after a reorder a user could, for a moment, get the profile of the rule that used to be at that position. A rule now takes effect only once its configuration is applied.

FreeRADIUS 3.2.10

The radius (AAA) and nac images move from FreeRADIUS 3.2.8 to 3.2.10, built from a pinned tag of the Taranac fork. It carries the fixes from the FreeRADIUS advisory of 1 June 2026: a long NAS-Filter-Rule that could crash the server before the shared secret was checked, buffer overflows in EAP-MSCHAPv2, EAP-MD5 and TEAP, and memory leaks.

Templates run in a sandbox

Operator-written email layouts, email templates and SMS templates could run code on the server. They are now rendered in a sandbox and checked on every save; a template that reaches outside it is refused. Previewing a layout with a custom body needs the settings edit permission.

EST, captive portal, collectors and MFA stop taking the client’s word

  • EST — the gateway forwards only the address that connected to it, so a device can no longer choose the IP Taranac records for it. The enrollment endpoint is no longer a password oracle: it checks the request first, then the password the way the web login does — locked accounts refused, failures counted and audited, rate-limited. A client certificate renews only a certificate this Taranac issued and still holds as active. Every refused enrollment is in the Activity log and syslog with its reason.
  • Captive portal — a guest can no longer approve their own sponsored access (the approve link carried the guest’s own session token; it is now a separate one-time secret and the decision is a button). A guest’s address is proven by the portal that served them, with a key only the core and its portals hold.
  • Collectors — a standalone collector checks the device’s SSH host key before logging in; it used to accept any key, so whoever answered on a device’s address received its credentials. The scanner aims only at its own subnet, and the core accepts only sightings a collector is entitled to report.
  • MFA service — an empty API key used to match an empty header; the service now refuses to start with a short key and believes X-Forwarded-For only from listed proxies.
  • Witness join — a witness join token no longer opens the cluster’s secrets; the witness gets only the etcd CA key.

Secrets stay off the command line

Join tokens and the master key used to be passed as arguments, which put them in shell history and in ps for anyone on the host. The join scripts now ask for the token at a prompt that does not echo, and take a file, stdin or an environment variable when there is no terminal; ./taranac restore takes --master-key-file or TARANAC_MASTER_KEY. Tokens reach curl on stdin, and no HA repair puts the replication password on a command line.

CRLs: signed, on every node, without a restart

  • A downloaded or uploaded CRL must be signed by the CA it is configured for; before, a CRL that merely carried the CA’s name was accepted.
  • A revoked EAP-TLS certificate is refused without restarting anything, and under HA every node applies the new CRL, not only the one that downloaded it. An Internal CA’s CRL is the same on every node and carries a CRL Number.
  • CRL alerts open when an EAP-TLS CRL is about to expire or has expired, and when a node fails to download one three times in a row. NAC Settings lists the CAs that have no CRL while CRL checking is on.
  • CRLs can be downloaded from private addresses (where AD Certificate Services publishes them); loopback, link-local and metadata addresses are still refused.

TACACS+ over TLS that accepts clients

Until now the TLS listener on port 6049 accepted no client at all. It now trusts every enabled internal CA by default, so a device with a certificate from Taranac’s own PKI — issued by hand or over EST — connects with no trust configuration. The TLS Client Trust card on the TACACS+ settings page shows that list; switch it to Selected CAs to narrow it. TLS 1.2 clients are accepted as well as 1.3, and changes apply without a restart.

The server certificates Taranac generates for TACACS+ over TLS and the EST gateway now carry the node’s addresses and are reissued automatically when those change or before they expire — a device that checks the server’s address accepts them. A certificate you put in place yourself is never replaced.

EST renewal on a bundle install

The est-gateway container — the mutual-TLS listener that renewal needs — ships with the bundle and starts with the stack on port 8445. Devices enroll with a password on 443 and renew with their current certificate on 8445; the key between the gateway and the API is generated for you. PKI Settings → EST shows both ports, a Copy full-chain CA button, and an optional list of allowed networks for IP SANs, so an account allowed to enroll can no longer get a certificate naming any address it likes. A fresh Cisco IOS-XE enrolls through the gateway, and stricter EST clients work.

Password+MFA: and a profile’s own MOTD

A TACACS+ login that will be asked for an OTP is prompted Password+MFA: , so users know before the password that a second factor follows. The text is the MFA password prompt setting (TACACS+ Settings → MFA); empty switches it off. A name that does not exist gets the same prompt as a user without groups. If you use a rule that exempts particular accounts (break-glass) from an MFA rule for everyone, leave this prompt empty: its absence would pick out exactly those accounts.

The MOTD of a TACACS+ profile now takes effect: it replaces the device, group or global MOTD for logins matched by a rule that assigns the profile, and keeps its line breaks.

etcd certificates renew themselves, and the CA can be replaced

  • Every cluster member — each database node and the witness — renews its own etcd certificate 45 days before it expires, keeping its key and addresses. Nothing is restarted, not etcd and not Postgres. ./taranac cluster renew-cert renews now; --all has every member renew and shows the old and new end dates.
  • ./taranac cluster rotate-ca replaces the cluster’s etcd CA on every member, with nothing restarted. Every member keeps a copy of the CA key, so a machine that left the cluster without being wiped still holds it; remove-node, remove-witness and detach now say so and name this command. An interrupted run says what state it left the cluster in, and running it again finishes the job.

Smaller additions

  • Devices and Users can be filtered by a group (LDAP-synced groups included).
  • IP addresses in the SANs when issuing a TACACS+ or NAC server certificate.
  • SECURITY.md in the bundle: how to report a vulnerability and what happens next.

HA joins and conversions that can always be finished

An HA conversion or a node join that stops half-way now always has a way forward and a way back. Among the fixes: add-node no longer fails about one time in 64, an interrupted join is finished with ./taranac up -d on that node, a node whose join stopped half-way is no longer taken for the witness, and adding a node no longer discards its database before finding out it cannot join. A passed failover rehearsal no longer ends by calling a healthy cluster degraded, and diagnose --ha stops flagging what a by-the-book cluster looks like.

Ports are one number end to end

TACACS_PORT, TACACS_TLS_PORT, RADIUS_AUTH_PORT, RADIUS_ACCT_PORT, NAC_AUTH_PORT and NAC_ACCT_PORT are now the port on the host, the port the daemon listens on inside its container and the port the settings pages show. Devices keep using the port they use today. To change one, edit .env and run ./taranac up -d.

Other fixes

  • A TACACS+ configuration change is always applied, and replacing the active TACACS+ server certificate no longer fails at random.
  • A % in a login banner or rule message is shown as typed.
  • NAC accounting Start/Stop is no longer dropped when the database is busy.
  • The hourly LDAP computer sync no longer deadlocks with the network scanner.
  • Every web response carries each security header once.
  • The users Validity filter filters, and a list filter no longer shows an id after a reload.

1.3.3 is available now through ./taranac update — read What to do when updating first. The full list of changes is in the release’s CHANGELOG.md. If you find a way around one of these bolts, please tell us privately through support rather than in a public issue.