Cambium Networks PMP 450 Series, Installation Manual

Page: 174 / 292

Chapter 3: System planning 174
not rely on the root account for access to the modules.
Each module supports four or fewer user accounts, regardless of account levels. The available levels are
l
ADMINISTRATOR, who has full read and write permissions. This is the level of the root and admin
users, as well as any other administrator accounts that one of them creates.
l
INSTALLER, who has permissions identical to those of ADMINISTRATOR except that the installer
cannot add or delete users or change the password of any other user.
l
TECHNICIAN, who has permissions to modify basic radio parameters and view informational web
pages.
l
GUEST, who has no write permissions and only a limited view of General Status tab.
l
Admin, Installer and Tech accounts can be configured as READ-ONLY. This will allow the account to
only see the items.
The ability to view information of General Status tab can be controlled by the "Site Information Viewable
to Guest Users" under the SNMP tab.
From the factory default state, configure passwords for both the root and admin account at the
ADMINISTRATOR permission level, using the Account > Change Users Password page. (If configure only
one of these, then the other will still require no password for access into it and thus remain a security risk.)
If you are intent on configuring only one of them, delete the admin account. The root account is the only
account that CNUT uses to update the module.
After a password has been set for any ADMINISTRATOR-level account, initial access to the module GUI
opens the view of GUEST level.
Planning f or RA DIUS op er at ion
Configure RADIUS where remote authentication is required for users of the web-based interface. Remote
authentication has the following advantages:
l
Control of passwords can be centralized.
l
Management of user accounts can be more sophisticated. For example; users can be prompted by
a network manager to change passwords at regular intervals. As another example, passwords can
be checked for inclusion of dictionary words and phrases.
l
Passwords can be updated without reconfiguring multiple network elements.
l
User accounts can be disabled without reconfiguring multiple network elements.
Remote authentication has one significant disadvantage in a wireless link product such as 450 Platform
Family. If the wireless link is down, a unit on the remote side of the broken link may be prevented from
contacting a RADIUS Server, with the result that users are unable to access the web-based interface.
One useful strategy would be to combine RADIUS authentication for normal operation with a single
locally-authenticated user account for emergency use.
PMP 450 Platform Family SM provides a choice of the following authentication methods:
l
Phase 1:
o
EAP-MSCHAPv2
o
EAP-TTLS