Windows 2000 - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

To create the user:
Open the $PREFIX/etc/raddb/user file in a text editor and add user names and roles for users who will
•
be accessing the switch and authenticating RADIUS.
The user will log in using the role specified with Brocade-Auth-Role. The valid roles include Root, Admin,
SwitchAdmin, ZoneAdmin, SecurityAdmin, BasicSwitchAdmin, FabricAdmin, Operator and User. You
must use quotation marks around "password" and "role".
For example, to set up an account called JohnDoe with the Admin role:
JohnDoe Auth-Type := Local, User-Password == "johnPassword" Brocade-Auth-Role =
"admin"
The next example uses the local system password file to authenticate users.
JohnDoe Auth-Type := System, Brocade-Auth-Role = "admin"
When you use Network Information Service (NIS) for authentication, the only way to enable
authentication with the password file is to force the switch to authenticate using Password Authentication
Protocol (PAP); this requires the -a pap option with the aaaConfig command.
Clients are the switches that will use the RADIUS server; each client must be defined. By default, all IP
addresses are blocked.
4/256 SAN Director and DC SAN Backbone Director (short name, DC Director) models send their
RADIUS requests using the IP address of the active CP. When adding clients, add both the active and
standby CP IP addresses so that, in the event of a failover, users can still log in to the switch.
To enable clients:
1. Open the $PREFIX/etc/raddb/client.config file in a text editor and add the switches that are to be
configured as RADIUS clients.
For example, to configure the switch at IP address 10.32.170.59 as a client:
client 10.32.170.59
secret
shortname
nastype
In this example, shortname is an alias used to easily identify the client. Secret is the shared secret
between the client and server. Make sure the shared secret matches that configured on the switch (see
"To add a RADIUS server to the switch
Save the file $PREFIX/etc/raddb/client.config then start the RADIUS server as follows:
$PREFIX/sbin/radiusd

Windows 2000

The instructions for setting up RADIUS on a Windows 2000 server are listed here for your convenience but
are not guaranteed to be accurate for your network environment. Always check with your system
administrator before proceeding with setup.
Configuring RADIUS service on Windows 2000 consists of the following tasks:
• Installing internet authentication service (IAS)
For more information and instructions on installing IAS, refer to the Microsoft web site.
• Enabling the Challenge Handshake Authentication Protocol (CHAP)
If CHAP authentication is required, then Windows must be configured to store passwords with
reversible encryption. Reverse password encryption is not the default behavior; it must be enabled.
If a user is configured prior to enabling reverse password encryption, then the user's password is stored
and cannot utilize CHAP. To use CHAP, the password must be re-entered after encryption is enabled. If
the password is not re-entered, then CHAP authentication will not work and the user will be unable to
authenticate from the switch.
• Configuring a user
IAS is the Microsoft implementation of a RADIUS server and proxy
database to verify user login credentials; it does not list specific users, but instead lists user groups.
= Secret
= Testing Switch
= other
configuration:" on page 78).
.
IAS uses the Windows native user
Fabric OS 6.x administrator guide 73