Cyclades AlterPath ACS, Справочник по командам

Страница: 94 / 420

78
Authentication
service: The service that should be enabled. The default is ppp. If you are enabling
another service, for example, “raccess” authorization on the TacacsPlus server, then it
should be mentioned in this field on ACS.
protocol: The default is lcp (line control protocol). Specify another paramter if required.
timeout: This is the timeout (in seconds) for a TacacsPlus authentication query to be answered.
retries: Defines the number of times each TacacsPlus server is tried before another is contacted.
The first server authhost1 is tried for the specified number of times, before the second authhost2 ,
if configured, is contacted and tried for the specified number of times. If the second server fails to
respond TacacsPlus authentication fails.
Configuring the authorization on ACS to access the serial ports [CLI]
In CLI mode, enter the following string:
1. cli > config security authentication tacplusraccess yes
2. cli > config physicalports <serial port number> access users/groups <list of users or
group names separated by commas>
Save the configuration to flash
3. cli > config > savetoflash
Configuring a RADIUS authentication server
On the server, edit /etc/raddb/users and add a new string attribute (ATTRIBUTE
Framed-Filter-Id) similar to the following example?
groupuser1 Auth-Type= Local, Password =”xxxx”
Service-Type=Callback-Framed-User,
Callback-Number=”305”,
Framed-Protocol=PPP,
Framed-Filter-
Id=”:group_name=<Group1>[,<Group2>,...,<GroupN>]”,
Fall-Through=No
If the Frame-Filter-Id already exists, just add the group_name to the string starting with
a colon “:”
On the ACS, edit /etc/raddb/server
format:
auth1 server[:port] secret [timeout] [retries]
acct1 server[:port] secret [timeout] [retries]