Asentria SiteBoss 530 User Manual
80
RADIUS Security
Description
RADIUS (Remote Authentication Dial In User Service) is feature is used to offload authentication, authorization, and
accounting (AAA) work to a RADIUS server, instead of doing that work on the unit. Prior to the introduction of the
RADIUS feature, AAA was done on the unit via the User Profiles settings and the Audit Log, although it was never
explicitly called AAA in our documentation up to this point. With the introduction of the RADIUS feature, AAA can now
be done with a RADIUS server via the RADIUS protocol. A RADIUS server is one instance of a AAA server in that it
offers authentication, authorization, and accounting services to client machines, such as the unit. The next few
sections go into more detail about how the RADIUS feature works.
Overview
The RADIUS feature is enabled by setting the
sec.mode
Setting Key to RADIUS or setting the Security
Settings/Security Mode option to RADIUS. You configure a primary and/or secondary RADIUS server address (or
hostname), as well as secrets for each. The secret is for authenticating the network traffic between the unit and the
RADIUS server. The unit makes transactions with the RADIUS server in order to:
•
authenticate a user (
•
determine what an authentic user is authorized to do (
)
•
log information about when an authentic user started and stopped a login session (
)
Each transaction has a timeout that specifies how long the unit will wait for a response from the server. (This is
configured with the
sec.radius.timeout
Setting Key or in the RADIUS Security Settings menu.) "A response
from the server" means a response that is authentic; i.e., the response network frame is verified as trusted. If a
response is not authentic, it could be due to an attacker, or corrupted network frame, or misconfiguration of the server
secret. A server can respond but if the secret is configured wrong then the unit will find it not authentic, and silently
discard the response. In this case, it is as if the unit had received no response at all. So from the perspective of the
unit, a response from a RADIUS server is one that is both received
and
authentic.
If no response arrives after the timeout, or if the unit could not transmit to the server in the first place (the server was
unreachable, because, for example, no network link, or no network configured on the unit), the unit can try again, up to
a limit as configured with
sec.radius.retries
Setting Key or in the RADIUS Security Settings menu. If the unit
exhausts all retries for authentication/authorization transactions, it has three options determined in this order:
1. try the same transaction with the secondary server (if its address/hostname and secret are configured). If the
secondary server responds, authentication/authorization will succeed/fail according to that server's response.
In any other case (secondary server unconfigured or configured but unreachable), the unit proceeds to step 2.
2. try to authenticate and authorize the user using the local User Profiles configuration (if its configured, when
sec.radius.fallback.mode
= USER PROFILES
). If the user fails to authenticate with the User Profiles
configuration (or if
sec.radius.fallback.mode
= NONE
) then the unit proceeds to step 3.
3. give up; the unit cannot authenticate the user so the user cannot log in.
If a RADIUS server deems a user authentic then it passes back authorization info to the unit. So authentication and
authorization happen in one transaction. Accounting happens in a separate transaction. Once the unit sees that an
authentic user is authorized to do what they intend to do, the unit sends a RADIUS accounting start message to the
RADIUS server that originally authenticated the user. When the user's session ends, the unit sends an accounting
stop message to that same server.
In sum, the RADIUS feature enables the unit do AAA transactions with a RADIUS server in order to:
•
determine if a user is actually who they claim to be
•
determine if a user is authorized to do what they want to do, and
•
log when that user starts and stops their session
Содержание SiteBoss 530
Страница 6: ......
