User Manual
LTU Orion 3
36
NOTE:
RADIUS subsystem depends on Advanced Security settings. SECURE ON
command has to be enabled before activating the RADIUS service
The Orion3 modem acts as RADIUS client. It will request user authentication and authorisation
from RADIUS server if operator will access command line or WEB interface of the device.
NOTE:
The current realisation of RADIUS protocol is designed for authentication and
authorisation of the device operator. It is not intended for granting or disallowing an access
from LAN ports to the network.
Orion3 RADIUS client supports one or two RADIUS servers. The following options are
configurable:
The authentication and authorisation process has the following scenario: as soon as operator
opens console session through Telnet, SSH or Serial interface, or if he opens WEB session and
connects to the HTTP server of the device, the LOGIN prompt appears. Operator enters the
USERNAME/PASSWORD pair and the RADIUS client (modem) sends authentication request to
the first RADIUS server. If the USERNAME/PASSWORD pair match the server database, the
operator will be authorized and access to CLI or WEB interface will be granted. If either
USERNAME/PASSWORD pair, or shared key doesn't match the server database record, the
access will be disallowed. Operator has 3 attempts per session to authenticate himself.
If first RADIUS server didn't reply during a defined timeout, the build-in modem RADIUS client
tries to authenticate the user at the second RADIUS server. If the second server didn't reply, the
client tries the first server again. This sequence keeps running until the number of retries counter
expires. The number of retries is user defined.
If the whole authentication sequence fails, the build-in modem RADIUS client tries to authenticate
and authorise the operator using the local user record.
NOTE:
It is not possible to authenticate user with local user record, if at least one RADIUS
server is running and accessible from the build-in client.
3.2.2.9.1 RADIUS Server Setup with Defined Vendor Specific Attributes
As an example we will configure freeradius server running on Linux Debian/Ubuntu platform.
Server will use Vendor Specific Attributes field during message exchange.
Freeradius server can store its configuration in SQL database or in plain text files. We will select
second way because of simplicity.
Vendor configuration. File dictionary.flexdsl
First of all we need to tell freeradius server to use Vendor Specific Attribute for the access to
FlexDSL equipment. We need to create the following text file:
File is located at /usr/share/freeradius/dictionary.flexdsl
Parameter
Value
Description
Server IP
IP Address
IP address of primary and secondary RADIUS Server.
Server port
0-65535
UDP Port, the RADIUS server is listen on for incoming
connections. Default port is 1812.
Shared key
String (64
symbols)
A passphrase. It must be the same for RADIUS server and all
clients. If two RADIUS servers are used, the passphrase can
be unique for each server.
Retries
0-10
Number of retries, the client will use to authenticate the user on
both RADIUS servers. 0 means no attempts. Default value is 2.
Timeout, seconds
1-5
Time interval between authentication attempts. Default value is
2 seconds.