Cyclades AlterPath ACS, Справочник по командам

Страница: 93 / 420

AlterPath ACS Command Reference Guide
77
Authentication
3.4 Group Authorization
This feature enables the “group” information retrieval from the authentication servers
TACACS+, RADIUS, and LDAP, and adds another layer of security by adding a
network-based authorization. It retrieves the “group” information from the
authentication server and performs an authorization through ACS.
The following sections describe the procedures to configure TACACS+, RADIUS, and
LDAP authentication servers, and the corresponding configuration process on ACS.
Configuring a TACACS+ authentication server
On the server, add “raccess” service to the user configuration and define which group or
groups the user belongs to.
user = <username>{
service = raccess{
group_name = <Group1>[,<Group2,...,GroupN>];
}
}
On the ACS, edit the following parameters in the /etc/tacplus.conf file.
authhost1= 192.168.160.21
accthost1= 192.168.160.21
secret=secret
encrypt=1
service=ppp
protocol=lcp
timeout=10
retries=2
authhost1: This address indicates the location of the TacacsPlus authentication server. A second
TacacsPlus authentication server can be configured with the parameter authhost2 .
accthost1: This address indicates the location of the TacacsPlus accounting server, which can be
used to track how long users are connected after being authorized by the authentication server. Its
use is optional. If this parameter is not used, accounting will not be performed. If the same server
is used for authentication and accounting, both parameters must be filled with the same address. A
second TacacsPlus accounting server can be configured with the parameter
accthost2 .
secret: This is the shared secret (password) necessary for communication between the ACS and
the TacacsPlus servers.
encrypt: The default is 1 which means encryption is enabled. To disable encryption
change the value to 0.