Extreme Networks ExtremeWare XOS Guide Manual page 246

Security
get changes in the users file to take place. Extreme RADIUS uses the file named profiles to specify
command lists that are either permitted or denied to a user based on their login identity. Changes to the
profiles file require the RADIUS server to be shutdown and restarted. Sending a HUP signal to the
RADIUS process is not enough to force changes to the profiles file to take effect.
When you create command profiles, you can use an asterisk to indicate any possible ending to any
particular command. The asterisk cannot be used as the beginning of a command. Reserved words for
commands are matched exactly to those in the profiles file. Due to the exact match, it is not enough to
simply enter "sh" for "show" in the profiles file, the complete word must be used. Commands can still
be entered in the switch in partial format.
When you use per-command authentication, you must ensure that communication between the
switch(es) and radius server(s) is not lost. If the RADIUS server crashes while users are logged in, they
will have full administrative access to the switch until they log out. Using two RADIUS servers and
enabling idle timeouts on all switches will greatly reduce the chance of a user gaining elevated access
due to RADIUS server problems.
RADIUS Server Configuration Example (Merit)
Many implementations of RADIUS server use the publicly available Merit
get a copy, search for the server on the web site at:
www.merit.edu
Included below are excerpts from relevant portions of a sample Merit RADIUS server implementation.
The example shows excerpts from the client and user configuration files. The client configuration file
( ) defines the authorized source machine, source name, and access level. The user
ClientCfg.txt
configuration file ( ) defines username, password, and service type information.
users
ClientCfg.txt
#Client Name Key
#---------------- ---------------
#10.1.2.3:256 test
#pm1 %^$%#*(&!(*&)+
#pm2 :-):-(;^):-}!
#merit.edu/homeless hmoemreilte.ses
#homeless testing
#xyz.merit.edu moretesting
#anyoldthing:1234 whoknows?
10.202.1.3 andrew-linux
10.203.1.41 eric
10.203.1.42 eric
10.0.52.14 samf
users
user Password = ""
Filter-Id = "unlim"
admin Password = "", Service-Type = Administrative
Filter-Id = "unlim"
eric Password = "", Service-Type = Administrative
Filter-Id = "unlim"
albert Password = "password", Service-Type = Administrative
ExtremeWare XOS 11.1 Concepts Guide
[type] [version]
-------------- ---------
type = nas v2
type=nas
type nas
type proxy v1
type=Ascend:NAS v1
type=NAS+RAD_RFC+ACCT_RFC
type=nas
type=nas
type=nas
type=nas
©
AAA server application. To
[prefix]
--------
pfx
pm1.
pm2.
246