4.
User Privilege Levels
MN700004 Rev 01
26
P r i v i l e g e D e s c r i p t i o n
guest
(15): Read-only privilege in non-privileged mode (cannot execute the enable
command)
RADIUS Authentication and Privilege Groups
In addition to the RADIUS server configuration, the authentication and privilege groups
require the following steps:
1. Copy an additional file, for example with name dictionary.nokia, to the same folder in
which the RADIUS configuration files are installed.
2. For all user, assign a privilege in the users file (refer to the example in dictionary.nokia
file).
3. Add the dictionary.nokia file to the dictionary file that is part of the RADIUS
configuration files.
Dot1x users with assigned Administrator privilege have two user names and passwords - one
required from the for dot1x configuration and one for authentication.
The following example describes how to assign privilege to users through RADIUS
authentication. The example refers only to freeRADIUS server authentication. The format
may be different for other distributions of RADIUS server.
In general privilege levels are vendor specific attributes and are between 0 and 15. Users
without privilege or wrong privilege are assigned privilege “
Guest
”.
1. To describe Nokia vendor specific extensions, add a file with the name dictionary.nokia
to RADIUS dictionaries. The file dictionary.nokia contains the following text:
VENDOR
NOKIA
738
ATTRIBUTE
NOKIA-privilege-group
1
integer NOKIA
VALUE
NOKIA-privilege-group
Administrators 0
VALUE
NOKIA-privilege-group
Network-admins 4
VALUE NOKIA-privilege-group Technicians 8
VALUE
NOKIA-privilege-group
Users
12
VALUE
NOKIA-privilege-group
Guests
15
2. Include the file dictionary.nokia in the main dictionary file:
INCLUDE /usr/local/etc/raddb/dictionary.nokia
3. Configure the users by typing in the file
users
the following:
test
Auth-Type := Local, User-Password == "test"
Reply-Message = "Hello, %u",
Nokia-privilege-group = Network-admins
Nokia-privilege-group
is the vendor-specific extension that carries the privilege information.
