RADIUS Authentication

Starting in 3.0, ProVision supports 6connect vendor-specific attributes (VSAs) for use with RADIUS authentication. To use these attributes, you must perform the following procedures:

Add the 6connect VSA to the Radius Installation

To use the 6connect VSA, the attributes must be defined on the RADIUS server. Add the following RADIUS dictionary file to your RADIUS server and name it dictionary.6connect:

Important Note:  Between version 3.9.3 and 4.0, the permissions structure for ProVision was significantly changed.  Make sure you following the version specific instructions below.

ProVision 3.9.3 and prior:

...

...

ProVision 4.0 and greater:

...

VENDOR

6connect

36009

BEGIN-VENDOR

6connect

ATTRIBUTE

6connect_user_group

 10

 string
#A 6connect User Group to which this user belongs.

END-VENDOR

 6connect

Configure Radius Accounts

On the Radius server, configure the user accounts that will have access to the ProVision system.

An example of a ProVision account configuration for the user file on a Freeradius system for version 3.9.3 and prior:

#A user with full IPAM prvileges and view only DNS privs

joe Cleartext-Password := "testing128"
   priv_admin = 1,
   priv_ipam_v = 1,
   priv_ipam_c = 1,
   priv_ipam_d = 1,
   priv_ipam_m = 1,
   priv_swip = 1,
   priv_email = 1,
   priv_dns_v = 1

An example of a ProVision account configuration for the user file on a Freeradius system for version 4.0 and greater:

Example: To  To add a new radius user, edit the 'users' file found at /etc/raddb/users and add a block like:

bobber  Cleartext-Password := "hello"
        6connect_user_group = "Global Admins,Group 2,Group 1,Group Nonexistent"Nonexistant"

The Radius server must be restarted every time you add, remove, or modify users. To restart the Radius server, use this command:

/etc/init.d/radiusd restart

Test Radius Accounts

For 3.9.3 and priorProVision 4.0 and higher, test and response should look like the following:

To query a radius server, use the following command format:

radtest [USERNAME] [USERPASSWORD] [SERVER] 0 [SECRET]

Example:

radtest bobber hello 208.39.140.106 0 6connect

A successful response will look like this:

#>radtest test test 50.23.215.162 6connect
  Sending Access-Request of id 179198 to 50208.2339.215140.162106 port 1812
  User-Name = "testbobber"
  User-Password = "testhello"
  NAS-IP-Address = 1067.124221.47240.6229
  NAS-Port = 0
  Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Accept packet from host 50208.2339.215104.162106 port 1812, id=179198, length=68
  priv_admin = 1
  priv_ipam_c = 1
  priv_ipam_m = 1
  priv_ipam_d = 1

For 4.0 and higher, test and response should look like the following:

﹤insert example﹥

69
Attr-10 = 0x476c6f62616c2041646d696e732c47726f757020322c47726f757020312c47726f7570204e6f6e6578697374616e74

A rejected response may look like this:

Sending Access-Request of id 68 to 208.39.140.106 port 1812
User-Name = "bobberbro"
User-Password = "hello"
NAS-IP-Address = 67.221.240.229
NAS-Port = 0
Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Reject packet from host 208.39.104.106 port 1812, id=68, length=20

Configure ProVision for Radius Authentication

To configure the use of Radius authentication with ProVision, follow the steps below.

• Log into 6connect ProVision
• Go to Admin -﹥ General Settings -﹥ > Authentication
• Ensure that Radius functions are marked as available.  Radius functions are always available on 6connect cloud instances.  Radius functions are available on VM Images and Local Installations only if the relevant PHP Pear Radius Libraries have been installed.
  Image Added
  
• Click the Radius Enable checkbox.
• Fill in the hostname or ip address, authentication ports, accounting port, and shared Radius key as specified.