Tripp Lite B093-004-2E4U-V Owner's Manual

Loading ...

177

9.1.12 Authentication Testing

The Authentication Testing tab (ﬁrmware version 3.5.2u3 and later) enables the connection to the remote authentication

server to be tested.

9.2 PAM (Pluggable Authentication Modules)

The console server supports RADIUS, TACACS+ and LDAP for two-factor authentication via PAM (Pluggable Authentication

Modules). PAM is a ﬂexible mechanism for authenticating users. A number of new ways of authenticating users have become

popular. The challenge is that each time a new authentication scheme is developed, it requires all the necessary programs

(login, ftpd, etc.) to be rewritten to support it.

PAM provides a way to develop programs that are independent of authentication scheme. These programs need

“authentication modules” to be attached to them at run-time in order to work. Which authentication module is to be attached

is dependent upon the local system setup and is at the discretion of the local Administrator.

The console server family supports PAM with the following modules added for remote authentication:

RADIUS - pam_radius_auth (http://www.freeradius.org/pam_radius_auth/)

TACACS+ - pam_tacplus (http://echelon.pl/pubs/pam_tacplus.html)

LDAP - pam_ldap (http://www.padl.com/OSS/pam_ldap.html)

Further modules can be added, as required.

Changes may be made to ﬁles in /etc/conﬁg/pam.d / which will persist, even if the authentication conﬁgurator is run.

• Users added on demand:

When a user attempts to log in, but does not already have an account on the console server, a new user account will be

created. This account will have no rights and no password set. They will not appear in the Tripp Lite conﬁguration tools.

Automatically added accounts will not be able to log in if the remote servers are unavailable.

• Administrator rights granted over AAA:

Users may be granted Administrator rights via networked AAA. For TACACS, a priv-lvl of 12 of above indicates an

administrator. For RADIUS, administrators are indicated via Framed Filter ID. See the example conﬁguration ﬁles below for

more information.

• Authorization via TACACS, LDAP or RADIUS for using remote groups:

Refer to 9.1.6 Group Support with Remote Authentication.

• Authorization via TACACS for both serial ports and host access:

Permission to access resources may be granted via TACACS by indicating a Tripp Lite device and a port or networked host

the user may access. See the example conﬁguration ﬁles below for more information.

9. Authentication

Loading ...

Tripp Lite B093-004-2E4U-V 4-Port Console Server with 4G LTE Cellular Gateway, Dual GbE NIC, 4Gb Flash and Dual SIM