Re: [Help-gnu-radius] Configuring Radius for Cisco equipment

[Chris Partsenidis]

Thanks for the input Gerald,

I've spent quite a bit of time these past days and I'm quite happy with the 
progress as I've managed to get the user authentication working, but with the 
'users' file. The goal is to use MySQL, but before I touch that part, I need to 
setup Radius the way the lab requires, get it working fully and then move it 
all to a database structure.

What I am now trying to figure out is how to get reverse-Telnet happening. From 
the Cisco documents I've downloaded, there is a sample script:

" 
Username = "pat"

Password = "goaway"

User-Service-Type = Shell-User

cisco-avpair = "raccess:port#1=maple/tty2""

Cisco states that you must use the 'aaa authorization' command in order to 
configure reverse telnet, which doesn't seem like a big problem to configure, 
however, I am unable to find any guidelines for the Radius server. I've 
searched the radius mailing list archives without success, so I'm hoping 
someone out there has implemented it and can enlighten me :)

Thanks in advanced!

_______________________
Chris Partsenidis
Founder & Senior Editor
http://www.firewall.cx
_______________________

  ----- Original Message ----- 
  From: Gerald 
  To: Chris Partsenidis 
  Cc: address@hidden 
  Sent: Thursday, December 02, 2004 5:52 PM
  Subject: Re: [Help-gnu-radius] Configuring Radius for Cisco equipment


  On Thu, 2 Dec 2004, Chris Partsenidis wrote:

  > ----------------------------
  > DEFAULT Auth-Type = System,
  >                 Login-Time = "Al",
  >                 Simultaneous-Use = 1
  >         Exec-Program-Wait = "/usr/local/sbin/telauth \
  >                              %C{User-Name} \
  >                              %C{Calling-Station-Id} \
  >                              %C{NAS-IP-Address} \
  >                              %C{NAS-Port-Id}"
  > -----------------------------------
  > and changed the Login-time to 'Al' and Exec-Program-Wait to
  > /usr/local/sbin/radauth since 'telauth' dosen't exist.

  Why use Exec-Program-Wait then? This example is for if you had an
  external script that you wanted to interact with the authentication. For
  testing purposes you can just use:

  username  User-Password = "IamApassword",
                  Simultaneous-Use = 1
          Service-Type = Shell-User,
                  Framed-Protocol = PPP

  (The FP = PPP is probably not necessary, but I know that example is
  syntactically correct.)

  Or if this radius server is elusively for authenticating the lab.

  DEFAULT Auth-Type = System,
  Login-Time = "Al",
  Simultaneous-Use = 1
  Service-Type = Shell-User

  This would allow anyone who successfully authenticates off of the system
  password file access to the privileged mode of any cisco router you
  point to this server for authentication.

  > radius-server host 192.168.0.15 auth-port 1645 acct-port 1646 key firewall
  > radius-server retransmit 3

  myrouter(config)#radius-server key ?
    0     Specifies an UNENCRYPTED key will follow
    7     Specifies HIDDEN key will follow
    LINE  The UNENCRYPTED (cleartext) shared key

  Looks like you forgot to tell the router the key.

  An Example of how we used attrib to just give our admins enable access
  with the attrib mysql database:

  +--------------+-------------------+-----------------+------+
  | user_name    | attr              | value           | op   |
  +--------------+-------------------+-----------------+------+
  | username     | Service-Type      | Shell-User      | NULL |
  +--------------+-------------------+-----------------+------+

  The router needs the key and Exec-Program-Wait isn't what you want I don't 
think.

  Related reading material:
  
http://www.cisco.com/univercd/cc/td/doc/product/software/ios113ed/113ed_cr/secur_c/scprt2/scradius.htm
  http://www.gnu.org/software/radius/manual/html_mono/radius.html#SEC347

  Gerald