Asentria SiteBoss 530 User Manual
83
Locking yourself out
Be careful when you are configuring RADIUS, you may lock yourself out of the unit, which means there is no way to
gain access to the unit again: you must return it in order for it to be reinitialized at the factory. There are four ways
around this:
1. If you are locked out because there is something wrong with the primary RADIUS server (i.e., it is
reachable but it is incorrectly rejecting authentication requests), then configure a secondary (redundant)
one, if you have the resources for that.
2. The unit attempts to detect an invalid RADIUS configuration, and if it finds it, it automatically authenticates
you using User Profiles. An invalid RADIUS configuration is one where (primary serverecret is not
configured) and (secondary serverecret is not configured). So if you have misconfigured the unit in this
way, you can still get into the unit provided you know the credentials for a MASTER-rights user profile.
3. Configure the unit to fall back to User Profiles (
sec.radius.fallback.mode
=USER PROFILES
). This
means when all RADIUS servers configured are unreachable or reachable but unresponsive, the unit will
authenticate and authorize the user with its User Profiles configuration. If any RADIUS servers
(primaryecondary) are responsive, then when they reject a user, the unit will reject a user and
not
fall
back to authenticating with User Profiles. On the one hand this is an insurance policy against locking
yourself out, but on the other hand it still means you must maintain some local
authentication/authorization security configuration of the unit, which erodes the purpose of centralized
AAA.
4. If you end up in a situation where you cannot log in to the unit at all, there is one last resort before
returning the unit. There is a way to gain access with the
feature. When set to ON, the
user can tap the Reset button 5 times quickly (1-2 times per second), at which point the front-panel LEDs
will flash briefly for several seconds. The user will then have immediate Console access using the default
MASTER username and password.
o
sec.mode
(to USER PROFILES)
o
sec.consolereq
(to OFF)
o
sec.connectvia
(to every method of connecting)
o
"admin/password/MASTER" credentials for the user profile appropriate to the product
o
IO2 mode set to COMMAND (if applicable to product)
Note:
o
The Button Unlock feature can only be used if
sec.button.unlock
=ON
(which it is by default). If
you do not want the unit to grant access via this feature, then turn it off. However, if you subsequently
lock yourself out then there is no way to gain access to the unit: you must return it.
o
If you lock yourself out and gain access again with the Button Unlock feature, remember to
reconfigure the settings that were defaulted by the Button Unlock feature to maintain your prior
security configuration!
o
When tapping the Reset button, tap it 5 times at a frequency of 1-2 times per second. Do not hold in
the Reset button otherwise that will reset the unit. Just tap it like you click a mouse button.
RADIUS server configuration
Some configuration for the RADIUS server is vendor-dependent, such as how you configure client machines and
users. Likewise there is vendor-independent configuration that tells the RADIUS server what vendor-specific RADIUS
attributes should be included in Access-Accept frames. All authorization data is encapsulated by these vendor-specific
attributes in a file called the RADIUS dictionary. The Asentria RADIUS dictionary (named dictionary.asentria) is
included on the resource CD that ships with the unit, or can be requested from
to be input into your RADIUS server. The attributes are listed below. When you configure a user on the RADIUS
server, you must in some way specify values for these attributes -- this is how you tell the RADIUS server (and the
unit) explicitly what a user is authorized to do. The values for each attribute correspond exactly to the traditional
settings used on the unit for User Profiles authorization.
Содержание SiteBoss 530
Страница 6: ......
