Appendix D – User Authentication Methods
Multi-Tech RouteFinder RF650VPN User Guide
211
Appendix D - User Authentication Methods
Introduction
The RouteFinder provides several proxy services to your network. While you can restrict access of your
internal clients to these proxy services at the IP level by using packet filter rules, you will run into
problems when you use a dynamic IP configuration protocol like DHCP or BOOTP internally. Thats where
Proxy User Authentication steps in. Here, clients must authenticate themselves to the proxy service with a
username and password, making it possible to limit access by-person instead of by-IP address. In
addition, it will also be possible to do "per-user" accounting, for example, in the HTTP proxy access logs.
Proxy Services and Authentication Methods
The RouteFinder currently provides the SOCKS5 and HTTP type proxy services. Both of these proxys
can be configured to accept all clients (access control based on IP addresses) or only clients providing a
valid username and password (User Authentication). If you select to use User Authentication for either of
these proxy services, you must select a method for the RouteFinder to validate the supplied credentials.
The RouteFinder currently supports User Authentication against:
- a RADIUS server
- an NT SAM User Base
- users defined in
WebAdmin
(
"local" RouteFinder User Authentication
)
RADIUS User Authentication
With this method ASL will forward User Information to a RADIUS server. RADIUS is a protocol typically
used to authenticate and account Dialup Users for Remote Access. However the protocol is very flexible
and RADIUS servers are available for almost every operating system including Microsoft Windows NT
and 2000.
The RouteFinder's implementation of the RADIUS method allows you to configure access rights on both a
per-proxy and a per-user basis.
NT SAM (SMB) User Authentication
This method uses a Microsoft Windows NT/2000 domain controller to validate user accounts. Many
companys already run NT/2000 networks based on Microsofts NT or Windows 2000 ActiveDirectory
Domain concepts. The advantage of this method is that it is very easy to set up if you already run a PDC
(Primary Domain Controller) on your network. The disadvantage is that only a "flat" authentication model
is supported, meaning that either ALL or NONE of the existing users in the NT Domain will be allowed to
use a proxy service (meaning that you cannot differentiate between User A and User B).
"Local" RouteFinder User Authentication
This method does not need an external server to validate user accounts. You can add users with the
RouteFinder's Web Frontend and specify the allowed proxy types on a "per-user" basis.
