#default authentication = file /etc/passwd
accounting file = /var/log/tac_plus.acct
#default authorization = permit
#key = <changeme>        # comment while debug

# Limit group foo logins to routers 192.168.0.* and 192.168.1.*, except for the device 192.168.0.13
acl = foo_acl {
        deny = 192.168.0\.13$
        permit = 192.168.[01]\.
}
group = foo {
        acl = foo_acl
}
user = bar {
        member = foo
}

# Deny logins to certain hosts in a prefix and allow all others
acl = foo_acl {
        deny = 192.168.0\.(1|20|50|90)$
        permit = .*
}

# Limit devices on which a user or group can enable
user = bar {
	enableacl = foo_acl
}

# Define a different enable password for a specific user or group
user = bar1 {
        enable = des wa8N/a017BC
}

user = bar2 {
        enable = file /etc/tac_enable_pwd
}

user = bar3 {
        enable = cleartext "letmein"
}

