Tripp Lite B093-004-2E4U-V Owner's Manual

Loading ...

171

• Enter the Server Password.

• Click Apply. LDAP remote authentication will now be used for all user access to the console server and serially or network

attached devices.

LDAP The Lightweight Directory Access Protocol (LDAP) is based on the X.500 standard, but is signiﬁcantly simpler and

more readily adapted to meet custom needs. The core LDAP speciﬁcations are all deﬁned in RFCs. LDAP is a

protocol used to access information stored in an LDAP server. Further information on conﬁguring remote RADIUS

servers can be found at the following websites:

http://www.ldapman.org/articles/intro_to_ldap.html

http://www.ldapman.org/servers.html

http://www.linuxplanet.com/linuxplanet/tutorials/5050/1/

http://www.linuxplanet.com/linuxplanet/tutorials/5074/4/

9.1.5 RADIUS/TACACS User Conﬁguration

Users may be added to the local console server. If they are not added and they log in via remote AAA, a user will be added

for them. This user will not show up in the Tripp Lite conﬁgurators unless they are speciﬁcally added, at which point they are

transformed into a local user. The newly added user must authenticate using the remote AAA server and will have no access if

it is down.

If a local user logs in, they may be authenticated/authorized from the remote AAA server, depending on the chosen priority of

the remote AAA. A local user’s authorization is the union of local and remote privileges.

Example 1:

User Tim is locally added and has access to ports 1 and 2. He is also deﬁned on a remote TACACS server, which says he has

access to ports 3 and 4. Tim may log in with either his local or TACACS password, and will have access to ports 1 through 4.

If TACACS is down, he will need to use his local password, and will only be able to access ports 1 and 2.

Example 2:

User Sue is only deﬁned on the TACACS server, which says she has access to ports 5 and 6. When she attempts to log in, a

new user will be created for her and she will be able to access ports 5 and 6. If the TACACS server is down, she will have no

access.

Example 3:

User Paul is deﬁned on a RADIUS server only. He has access to all serial ports and network hosts.

Example 4:

User Don is locally deﬁned on an appliance using RADIUS for AAA. Even if Don is also deﬁned on the RADIUS server, he will

only have access to those serial ports and network hosts he has been authorized to use on the appliance.

If a “no local AAA” option is selected, the root will still be authenticated locally.

Remote users may be added to the administrator group via RADIUS or TACACS. Users may have a set of authorizations set

on the remote TACACS server. Users automatically added by RADIUS will have authorization for all resources, whereas those

added locally will still need their authorizations speciﬁed.

LDAP has not been modiﬁed and will still need locally deﬁned users.

Note: To interact with RADIUS, TACACS+ and LDAP with console server ﬁrmware pre-2.4.2, you must also set up the user accounts on the

local console server. All resource authorizations must be added to the local appliance. With this release, if remote AAA is selected, it is used

for password checking only. Root is always authenticated locally. Any changes to PAM conﬁgurations will be destroyed the next time the

authentication conﬁgurator is run.

9. Authentication

Loading ...

Tripp Lite B093-004-2E4U-V 4-Port Console Server with 4G LTE Cellular Gateway, Dual GbE NIC, 4Gb Flash and Dual SIM