RadiSys SEG-100, Руководство администратора

Страница: 154 / 198

8
Authentication
154
• Timeouts
A number of timeout values can be set for the profile:
• Idle timeout
• Session timeout
• Use timeouts sent by the authentication source
• Brute Force Attack Prevention
This option can be activated to control the following:
• Login attempts – This is the maximum number of login attempts for a given username
before a lockout occurs for that username.
• Lockout time – After a lockout occurs, this is the time that must elapse before further
login attempts are allowed for the locked out username.
Example 1: Creating an authentication profile with a local user database
This example creates an authentication profile called int_auth that will reference a local user
database that has already been defined called int_users.
Device:/> add AuthenticationProfile int_auth

AuthSource=Local

LocalUserDB=int_users
Example 2: Creating an authentication profile with RADIUS servers
This example creates an authentication profile called ext_auth that will reference two RADIUS
servers called rad1_server and rad2_server .
Device:/> add AuthenticationProfile ext_auth

AuthSource=RADIUS

RadiusServer=rad1_server,rad2_server
RADIUS authentication
Centralizing authentication
In a larger network topology with a larger administration workload, it is often preferable to
have a central authentication database on a dedicated server. When there is more than one
SEG in the network and thousands of users, maintaining separate authentication databases
on each device becomes problematic. Instead, an external authentication server can validate
username/password combinations by responding to requests from the SEG.
The RADIUS solution
To provide a centralized external authentication source, the SEG supports the Remote
Authentication Dial ‐ in User Service (RADIUS) protocol. RADIUS is an Authentication,
Authorization and Accounting (AAA) protocol widely used to implement the central database
approach.