I'm trying to implement tacacs authentication on a freebsd box as a client.  The box is actually a network appliance that SHOULD have this config built into its cli/ui but doesn't.  Since it's built on freebsd, it has the pam_tacplus.so library built in.My problem is that I wish to authenticate to our tacacs server, but I don't wish to configure local accounts on the appliance.  Here's the pam.conf file:su      auth        sufficient  pam_rootok.sosu      auth        sufficient  pam_unix.sologin   auth            required        pam_unix.sologin   account         required        pam_unix.sologin   password        required        pam_permit.sologin   session         required        pam_permit.softpd    auth            required        pam_unix.sosshd    auth            sufficient      pam_tacplus.so  template_user=testuser      sshd    auth            required        pam_unix.sosshd    account         required        pam_unix.sosshd    password        required        pam_permit.sosshd    session         required        pam_permit.sotelnetd auth            required        pam_unix.sopasswd  password        required        pam_unix.so     no_warn try_first_pass nullokother   auth            required        pam_unix.soThe tacacs server's ip address is stored in /etc/tacplus.conf and since I see failures in the tacacs server's log, I believe communication is successful.  Additionally, I can establish TCP session to server on port 49.When I try to log in via ssh as jimbob, here's what I see in the /var/log/auth.log:<auth.info> Lab-2 sshd[4952]: Invalid user jimbob from 10.0.0.1<auth.info> Lab-2 sshd[4952]: input_userauth_request: invalid user jimbob<auth.info> Lab-2 sshd[4952]: Failed none for invalid user jimbob from 10.0.0.1 port 52069 ssh2<auth.info> Lab-2 sshd[4952]: Failed publickey for invalid user jimbob from 10.0.0.1 port 52069 ssh2<auth.info> Lab-2 sshd[4952]: Postponed keyboard-interactive for invalid user jimbob from 10.0.0.1 port 52069 ssh2<auth.info> Lab-2 sshd[4952]: Postponed keyboard-interactive/pam for invalid user jimbob from 10.0.0.1 port 52069 ssh2<auth.err> Lab-2 sshd[4953]: error: ssh_msg_send: writeAfter searching around, this seems to apply.  This, however, talks about NSS, which is controlled by nsswitch.conf, which doesn't exist on this system.  There doesn't appear to be a tacacs plugin for NSS; I'm not sure that it would matter, in my case, if there were.So, is there a way to skip checking the local passwd file for a user before getting to the pam_tacplus.so library?  I'm guessing that if there were, the template_user= option would kick in and try to use 'testuser,' which DOES exist as a localuser:pw user show testusertestuser:*:1003:1003::0:0:User &:/home/testuser:/usr/bin/bash
pam_tacplus.so and sshd: skip user validation?
pam;sshd