Asentria SiteBoss 530 User Manual
82
Authorization
Once a RADIUS server deems a user is authentic, its necessary to determine what the user is authorized to do. For
example, a certain user may be, on the RADIUS server, configured and authorized to log in to the unit via telnet
command processor but not via the web UI. So if that user attempts to log in to the unit via the web UI, they will be
authenticated by the RADIUS server, but denied access by the unit. This happens because upon authentication, the
unit requires the RADIUS server to send it certain authorization data about the user. (If the RADIUS server does not
respond with all the required authorization data, the user is not allowed to log in to the unit, even though they were
authenticated by the RADIUS server.) The authorization data received by the unit essentially says "this user is not
allowed access via the web UI". The unit interprets this data by rejecting the user's web UI login attempt. To remedy,
the configuration on the RADIUS server would have to change to allow web UI access for that user. This is an
example of just one of the pieces of authorization data that the unit requires. The full set of data is detailed later in this
document.
When configuring users for access, be sure to limit their user rights (i.e., authorize them for sub-MASTER rights).
MASTER users have enough privilege to change the security settings on the unit, including creating their own user
profiles and changing the security mode away from RADIUS. If a user connects via RADIUS and is given MASTER
rights, then that user can change the security settings to fit what may be malicious intent. Rights are allocated by the
Asentria-User-Rights vendor-specific attribute defined later in this document.
Accounting
When a user is authentic and authorized, the unit sends RADIUS accounting start and accounting stop messages to
the RADIUS server that authenticated the user, when that user's login session begins and ends, respectively. If the
RADIUS accounting UDP port
sec.radius.acct.port
is set to 0 then the unit will not send accounting information.
For example, when a user logs in with RADIUS (in PAP mode) to the console port, the unit does the following four
things to or for the user:
1. authenticates
2. authorizes
3. sends accounting start information
4. starts a command processor
When the command processor session ends (either by the user explicitly disconnecting or lowering the handshaking
on the RS232), then the unit sends accounting stop information to the RADIUS server that authenticated that user (but
only if the unit had successfully sent accounting start information for that user when they logged in). Accounting
information being "successfully sent" means the unit could reach the RADIUS server and the server responded.
When the unit sends the RADIUS server accounting start and stop messages, it is actually sending RADIUS
Accounting-Request frames with the following RADIUS attributes:
•
Standard attribute: Acct-Status-Type, which is integer 1 for start or 2 for stop.
•
Standard attribute: Acct-Session-Id: the unit uses an RFC 4122 GUID as the value for this attribute; it is
used to correlate start and stop messages.
•
Standard attribute: User-Name (to specify who logged in or logged out)
•
Vendor-specific attribute: Asentria-Service-Type, which is a string that describes the kind of login session
the user started.
Limits of support
The unit does not support RADIUS Access-Challenge frame (which the RADIUS server can send in response to an
Access-Request frame); the unit interprets Access-Challenge as Access-Reject.
The unit does not support any Accouting-Request frames other than those with Acct-Status-Type set to 1 or 2.
SNMPv3 works only with users specified in the User Profiles configuration when the security mode is set to USER
PROFILES; SNMPv3 does not work with RADIUS.
Summary of Contents for SiteBoss 530
Page 6: ......
