Quick Reference

The most common tacctl commands on one card · Checked against tacctl 0.2.25

The most common tacctl commands on one card. The Tier column gives the lowest tier that can run each one: R read-only · O operator · E engineer (own scopes) · S superuser. Run any command family with no arguments for its usage. In the console and tacctl shell, ? shows help.

1. Everyday

Task	Command	Tier
Interactive prompt	`tacctl shell` (`--password-cache`)	R
Change own password	`tacctl passwd`	R
Server health	`tacctl status`	R
Find problems	`tacctl config validate`	O
Help	`tacctl <command> --help` · `tacctl man [<topic>]`	R
Password cache (your own choice)	`console password-cache on\|off` (console word)	O

2. Devices

Task	Command	Tier
List / filter	`tacctl device list [--scope s] [--vendor v] [--stale] [--differs]` (`--differs`: O)	R
Detail	`tacctl device show <n>`	R
Connect	`tacctl ssh <n> [-- <cmd>]`	R
Notices	`tacctl device notice list`	R
Health check	`tacctl device check <n> [--sources]`	O
Unregistered	`tacctl device discover [--snmp]`	O
Register	`tacctl device add <n> <ip> --vendor cisco\|juniper\|wti [--pull]`	E
Enroll discovered	`tacctl device enroll --discovered`	E
Edit field	`tacctl device address\|description\|location <n> <value>`	E
Rename / remove	`tacctl device rename <old> <new>` · `device remove <n>`	E
Copy at a bench address, then move into place	`tacctl device clone <n> <new> --staging <ip>` · `device rename <new> <n> --replace`	E
Re-pin key	`tacctl device hostkey <n> set SHA256:<fp>`	E
Drift state	`tacctl device config list [--differs]`	O
Read config	`tacctl device config pull <n>\|--scope s`	E
Diff / plan	`tacctl device config diff <n>` · `device config plan <n>`	E
Junos apply	`tacctl device config apply <n> [--check]`	E
Junos rollout of a scope	`device config apply --scope <s> --check`, then `apply <n>`, then `apply --scope <s>` (a script: `--confirmed --yes`)	E
List the shapes of a rollout	`tacctl device config shapes [list [--show <hash>]]`	S
File a hand-verified shape as confirmed	`tacctl device config shapes seed <n>`	S
Where the time of a run goes	`--timing` on `device config pull`, `diff --pull`, `plan --pull` or `apply`	E
Timing scale of a slow or distant device	`tacctl device timeout-scale <n> [<1-10>\|clear]` (the scale is in `device show`)	S
Back-out	`tacctl device config plan <n> --backout`	E
SNMP pool and default user	`tacctl config snmp v3-user add\|default\|list` (also `scope snmp <s>`, `device snmp <n>`)	S

3. Users

Task	Command	Tier
List / detail	`tacctl user list` · `user show <n>`	R
Add	`tacctl user add <n> <group> --scopes <s,…> [--email <address>]`	S
Email address	`tacctl user email <n> [<address>\|clear]`	S (show: R)
Password reset	`tacctl user passwd <n>`	S
Require / lift a password change	`tacctl user require-password-change <n> [on\|off]`	S
Scopes	`tacctl user scope <n> add\|remove\|replace <s,…>`	S
Change group	`tacctl user move <n> <group>`	S
Suspend / restore	`tacctl user disable\|enable <n>`	S
Remove	`tacctl user remove <n>`	S

4. Linux hosts

Task	Command	Tier
List / filter	`tacctl host list [--name t] [--ip a] [--scope s] [--stale]` · `host show <n>`	E
Check	`tacctl host check --all [--concurrency <n>]`	S
Push accounts	`tacctl host sync --all [--concurrency <n>]`	S
Enroll	`tacctl host enroll <user>@<host> --scope <s>`	S
Move / retire	`tacctl host move <n> <s>` · `host unenroll <n>`	S

5. Scopes

Task	Command	Tier
List	`tacctl scope list`	R
First-match order	`tacctl scope routing`	S
Who owns an IP	`tacctl scope lookup <ip>`	S
Prefixes	`tacctl scope prefixes <s> add\|remove <cidr>`	S
Rotate secret	`tacctl scope secret <s> generate`	S
Timing scale of a scope	`tacctl scope timeout-scale <s> [<1-10>\|clear]` (the scale is in `scope show`)	S
Break-glass accounts	`tacctl scope breakglass <s> add <user>`	S
Junos filter mode: show	`tacctl scope mgmt-acl <s> mode`	E
Junos filter mode: set	`tacctl scope mgmt-acl <s> mode ssh-only\|strict`	S

6. Emergencies

Task	Command	Tier
Preview lockdown	`tacctl emergency lockdown <s> enable --dry-run`	S
Lock down	`tacctl emergency lockdown <s> enable [groups] --reason "…"`	S
Status	`tacctl emergency lockdown status`	S
Lift	`tacctl emergency lockdown <s> disable`	S
Sync the scope’s hosts without being asked	`--yes` on `enable` or `disable`	S
Hold device/host	`tacctl breakglass hold <n> --reason "…"`	S
Release	`tacctl breakglass release <n>`	S
List holds	`tacctl breakglass list`	E
Firewall for held addresses	`tacctl config breakglass-firewall [reject\|drop\|off]`	S

7. This server

Task	Command	Tier
This server at a glance	`tacctl server show`	S
Show the server address	`tacctl server addresses`	S
Change it	`tacctl server addresses replace <ip>`	S
Name shown in the console	`tacctl server name [<label>\|unset]`	S
Timing scale of every device	`tacctl config devices timeout-scale [<1-10>]`	S
Where a backend listens	`tacctl server listen [show]`	S
Prometheus exporter	`tacctl server metrics [show]`	S
Rebuild or repair the server’s own login	`tacctl host enroll --local`	S

8. Logs and recovery

Task	Command	Tier
Live	`tacctl log tail -f`	O
Search	`tacctl log search <term>`	O
Failures (24 h)	`tacctl log failures`	O
Accounting	`tacctl log accounting [n]`	O
Filter any of the four	add `--since <t>` `--until <t>` `--user <n>` `--device <d>` (`--type` for accounting), `--json`	O
Snapshots	`tacctl backup list`	O
Diff / restore	`tacctl backup diff [ts]` · `backup restore <ts>`	S
Keep / unkeep a snapshot	`tacctl backup keep <ts>` · `backup unkeep <ts>`	S
Put back email or SNMPv3 users after a rollback	`tacctl backup recover <ts> [--only email,snmp-users]`	S
Audit trail	`journalctl -t tacctl -t tacctl-console`	—

9. Exit codes

0 ok · 1 refused/failed · 2 wrong arguments or a change is needed (--exit-code) · 3 refused to overwrite a hand edit · 130 interrupted. Details: Exit Codes.

See also: Getting Started · Command Reference Map · Glossary · man tacctl