_____________________________________________________________________
724-746-5500 | b lackb o x.co m
Page 129
If a local user logs in, they may be authenticated/authorized from the remote AAA server, depending on
the chosen priority of the remote AAA. A local user’s authorization is the union of local and remote
privileges.
Example 1:
User Tim is locally added, and has access to ports 1 and 2. He is also defined on a remote
TACACS server, which says he has access to ports 3 and 4. Tim may log in with either his local or
TACACS password, and will have access to ports 1 through 4. If TACACS is down, he will need to
use his local password, and will only be able to access ports 1 and 2.
Example 2:
User Ben is only defined on the TACACS server, which says he has access to ports 5 and 6. When
he attempts to log in, a new user will be created for him, and he will be able to access ports 5
and 6. If the TACACS server is down he will have no access.
Example 3:
User Paul is defined on a RADIUS server only. He has access to all serial ports and network hosts.
Example 4:
User Don is locally defined on an appliance using RADIUS for AAA. Even if Don is also defined on
the RADIUS server, he will only have access to those serial ports and network hosts he has been
authorized to use on the appliance.
If a “no local AAA” option is selected, then root will still be authenticated locally.
You can add remote users to the admin group via either RADIUS or TACACS. Users may have a set of
authorizations set on the remote TACACS server. Users automatically added by RADIUS will have
authorization for all resources, whereas those added locally will still need their authorizations specified.
LDAP has not been modified, and will still need locally defined users.
9.2
PAM (Pluggable Authentication Modules)
The
console server
supports RADIUS, , and LDAP for two-factor authentication
via
PAM
(Pluggable Authentication Modules). PAM is a flexible mechanism for authenticating users. Nowadays, a
number of new ways of authenticating users have become popular. The challenge is that each time a
new authentication scheme is developed, you need to rewrite all the necessary programs (login, ftpd,
etc
.) to support it.
PAM provides a way to develop programs that are independent of authentication scheme. These
programs need “authentication modules” to be attached to them at run-time in order to work. Which
authentication module is attached depends on the local system setup and is at the discretion of the local
Administrator
.
The
console server
family supports PAM with the following modules added for remote authentication:
RADIUS
- pam_radius_auth
(http://www.freeradius.org/pam_radius_auth/)
- pam_tacplus
(http://echelon.pl/pubs/pam_tacplus.html)
LDAP - pam_ldap
