Black Box ServSelect KV119A, Installer/User Manual

Page: 31 / 84

SERVSELECT™ IP SCPS INSTALLER/USER GUIDE
30
RADIUS authentication
RADIUS authentication uses a third party RADIUS server containing a user
database to authenticate SCPS users. The SCPS, functioning as a RADIUS client,
sends usernames and passwords to the RADIUS server. If a username and password
do not agree with equivalent information on the RADIUS server, the SCPS is
informed and the user is denied SCPS access. If the username and password are
successfully validated on the RADIUS server, the RADIUS server returns an
attribute that indicates the access rights defined for that username.
To use RADIUS authentication, you must specify information about the primary
RADIUS server and optionally, a secondary RADIUS server to be used as a backup.
The RADIUS server definition values specified in SCPS commands must match
corresponding values configured on the RADIUS server. On the RADIUS server,
you must include SCPS-specific information: the list of valid users and their access
rights for the SCPS. Each user-rights attribute in the RADIUS server’s dictionary
must be specified as a string containing the user’s access rights for the SCPS,
exactly matching the syntax used in the SCPS User Add command.
Consult your RADIUS administrator’s manual for information about specifying users
and their attributes. The exact process depends on the RADIUS server you are using.
You may optionally specify both RADIUS and local authentication, in either order.
In this case, authentication will be attempted initially on the first method specified.
If that fails, the second method will be used for authentication.
No authentication
When authentication is disabled, users are not authenticated. Telnet sessions to
serial ports are accepted immediately, and users are not asked for a username or
password. In this case, users are granted access only to the port to which they are
connected, including Break access.
Connections to the Telnet port (23), serial CLI and PPP are still authenticated, even
when authentication is expressly disabled. Generally, these communications paths
are used only by administrators, and authentication is enforced in order to establish
appropriate access rights.
Authentication may not be disabled when SSH session access is enabled.