gurkin33

From 6c46efc6d9d4d5583fb3290a43708e24aceff40f Mon Sep 17 00:00:00 2001
From: gurkin33 <ya@gurkin33.ru>
Date: Tue, 13 Oct 2026 09:08:25 +0300
Subject: [PATCH 1/2] tac_plus-ng: support "message PASSWORD" as a script
 action

The password prompt could be set per device and realm only. As a script
action in the ruleset it lets a rule choose the ASCII login prompt by
role, overriding the device setting:

gurkin33

From e612a3b527a7242e00be14a2a5cfb0b1904b7cb9 Mon Sep 17 00:00:00 2001
From: gurkin33 <ya@gurkin33.ru>
Date: Tue, 13 Oct 2026 08:15:44 +0300
Subject: [PATCH 1/2] tac_plus-ng: support "motd banner" as a script action

The motd banner could be set per device only. As a script action it
lets the ruleset choose the motd by role, overriding the device setting:

  rule netadmins {
      script {

gurkin33

From 13ed65098bbab2d65f9cec76077cc58f0441c02c Mon Sep 17 00:00:00 2001
From: gurkin33 <ya@gurkin33.ru>
Date: Tue, 13 Oct 2026 07:51:30 +0300
Subject: [PATCH] tac_plus-ng/config.c: profile cache: skip session specific
 users

The profile cache is keyed by the tac_user pointer. Users created by
MAVIS with "mavis cache timeout = 0" are session specific and freed
together with their session, so a later session on the same connection
may get a different user allocated at the same address and pick up the

gurkin33

From eb3b6606d7fae3f0cd109ef97185dcdc5f03b548 Mon Sep 17 00:00:00 2001
From: gurkin33 <ya@gurkin33.ru>
Date: Tue, 13 Oct 2026 07:42:10 +0300
Subject: [PATCH] tac_plus-ng/utils.c:parse_log_format(): don't return a shared
 static item for empty formats

An empty format string returned the address of a single static log_item,
shared by all empty formats in the configuration. fixup_banner() appends
"${message}${umessage}" to the end of the list, so every empty banner
appended another copy of that tail to the same item. With