RADIUS,
General
Microsemi PDS-408G Web Management User Guide Ver. 1.0.1, 03-2019
62
10
RADIUS,
10.1
General
RADIUS (Remote Authentication Dial-In User Service) and (Terminal Access Controller
Access Control System) are networking protocols that provide centralized Authentication, Authorization,
and Accounting (AAA or Triple A) management for users who connect to the unit over Web, telnet,
SSH. The remote username and password are sent to RADIUS/ Server for authentication
(user + password match/do not match) and authorization (privilege level) rather than being tested
locally using unit local configuration file.
10.1.1
General - Authentication, Access-Level terminology
•
Authentication
- Remote username and password is sent to RADIUS-Server for authentication
instead of tested locally by the unit. The RADIUS-Server determines if remote user should be
accepted or rejected.
•
Access-Level
- Remote user access-level is determined by the RADIUS-Server. For normal
unit operation, all remote users should obtain access level 15 (administrator) by remote
RADIUS-Server.
10.1.2
General - Setting up remote RADIUS Server
•
Successful RADIUS Server configuration must include two steps. The first step is to configure
RADIUS Server to acknowledge remote user username and password. The second step is
configuring the RADIUS Server so that RADIUS-Server
Access-Accept
reply message will
include AVP (Attribute value Pair) number 26 with the string
priv-lvl=15
, assigning admin (15)
privilege level to the user. Successful Radius-Server
Access-Accept
reply lacking the attribute
number 26 with the mentioned string will assign user privilege level number 1 out of 15 with no
ability to do any changes inside the unit.
•
Configuring Free-Radius users.conf configuration file:
Change
users.conf
as follows:
username Cleartext-Password := "pass"
Cisco-= "priv-lvl=15"
NOTE:
RADIUS/ configuration only will have no effect on remote user authentication over
Web, Telnet, SSH. To complete the configuration user must configure also authentication
method located under: Access Control
Telnet/SSH/Web