This took a while to find, so sending here to document. ScreenOS 6+ will authenticate via TACACS+. Necessary tac_plus.cfg snippet: service = netscreen { vsys = root privilege = read-write }