211
1.877.877.2269
BLACKBOX.COM
NEED HELP?
LEAVE THE TECH TO US
LIVE 24/7
TECHNICAL
SUPPORT
1.877.877.2269
CHAPTER 10: AUTHENTICATION
Enter the Server Address (IP or host name) of the remote Authentication server. Multiple remote servers may be specified in a
comma separated list. Each server is tried in succession.
Check the Server Protocol checkbox to select if SSL is to be used or enforced for communications with the LDAP server.
Console servers running firmware v3.11 and above offer three options for LDAPS (LDAP over SSL):
LDAP over SSL preferred will attempt to use SSL for authentication. If it fails, it will fall back to LDAP without SSL.
LDAP over SSL may fail due to certificate errors or the LDAP server not being contactable on the LDAPS port.
LDAP over SSL only. This setting will configure the console server to only accept LDAP over SSL. If LDAP over SSL fails, you will only
be able to log into the console server as root.
LDAP (no SSL) only. This setting will configure the console server to only accept LDAP without SSL. If LDAP without SSL fails, you
will only be able to log into the console server as root.
Check the Ignore SSL Certificate Error check box if you wish to ignore SSL certificate errors, allowing LDAP over SSL to work
regardless of these errors.
This allows you to use any certificate, self-signed or otherwise, on the LDAP server without having to install any certificates on
the console server.
If this setting is not checked, you must install the CA (certificate authority) certificate with which the LDAP server’s certificate was
signed onto the console server. For example, the LDAP server is serving with a certificate signed using the certificate myCA.crt.
NOTE: The certificate must be in CRT format and myCA.crt must be installed onto the console server at /etc/config/ldaps_ca.crt.
The filename must be ldaps_ca.crt. Copy the file to this location and filename manually using scp or the like. For example:
scp /local/path/to/myCA.crt
rt root@console_server:/etc/config/ldaps_ca.crt
Enter the Server Password.
Click Apply.
LDAP remote authentication will now be used for all user access to console server and serially or network attached devices
Further information on configuring remote RADIUS servers can be found at the following sites: http://ldapman.org/articles/intro_
to_ldap.html, http://ldapman.org/servers.html, http://linuxplanet.com/linuxplanet/tutorials/5050/1/, and http://linuxplanet.com/
linuxplanet/tutorials/5074/4/.
10.1.5 RADIUS AND TACACS USER CONFIGURATION
Users may be added to the local console server appliance. If they are not added and they log in via remote AAA, a user will be
added for them. This user will not show up in the console server configurators unless they are specifically added, at which point
they are transformed into a completely local user. The newly added user must authenticate off of the remote AAA server, and will
have no access if it is down.
If a local user logs in, they may be authenticated or authorized from the remote AAA server, depending on the chosen priority of the
remote AAA. A local user’s authorization is the union of local and remote privileges.
EXAMPLE 1
User Tim is locally added, and has access to ports 1 and 2. He is also defined on a remote TACACS server, which says he has
access to ports 3 and 4. Tim may log in with either his local or TACACS password, and will have access to ports 1 through 4. If
TACACS is down, he will need to use his local password, and will only be able to access ports 1 and 2.
