Servers sub-tab

Authentication server configuration is done on this page.

Edit Local Authentication

Click on the Index of the Local authentication server to enable/disable it, or set 2-Factor Authentication if a method is configured in the 2-Factor tab:

Add Remote Server

1. Go to Security :: Authentication :: Servers.

2. Click Add (displays dialog):

   

3. On Method drop-down, select one of the following authentication methods:
   - LDAP or AD, see Method: LDAP or AD

   - RADIUS, see Method: RADIUS authentication and authorization - TACACS+, see Method: TACACS+

   - Kerberos, see Method: Kerberos

4. On 2 Factor Authentication drop-down, select one (None, Enabled).

5. On Status drop-down, select one (Enabled, Disabled).

6. Select Fallback if denied access checkbox.

7. Enter Remote Server (IP address of remote server).

8. Click Save.

Method: LDAP or AD

1. Enter Base (root DN or a sublevel DN – highest point used to search for users or groups).
   
   

2. Select/unselect Authorize users authenticated with ssh public key checkbox (default: disabled).

3. On Secure drop-down, select one (On, Off, Start_TLS) (default: Off).

4. Select/unselect Global Catalog Server checkbox (if enabled, uses an Active Directory Global Catalog Server).

5. Enter LDAP Port (or accept "default").

6. Enter Database Username,  Database Password and Confirm Password.

7. Enter Login Attribute (contains username - for AD, default: sAMAccountName).

8. Enter Group Attribute (group identifier - for AD, default: memberOf).

9. Enter Search Filter.

10. Select/unselect Search Nested Groups (AD only) checkbox (default: disabled).

11. Enter Group Base.
    

    Example: OpenLDAP Configuration

    Status: True; Fallback if denied access: True; Remote Server: 192.168.1.1; Base: dc=zpe, dc=net; Secure: Off; Global Catalog Server: False; Database Username: cn=admin, dc=zpe, dc=net; Login Attribute: cn; Group Attribute: Member, UID

    Example: Active Directory Configuration

    Status: True; Fallback if denied access: True; Remote Server: 192.168.1.1; Base: dc=zpesystems, dc=com; Secure: Start TLSl; Global Catalog Server: True; Database Username: cn=Administrator, cn=Users, dc=zpesystems, dc=com; Login Attribute: sAMAccountName; Group Attribute: memberOf

Method: RADIUS authentication and authorization

RADIUS (Remote Access Dial In User Service ) provides central authentication for users.

It is a client server protocol that runs on application layer. It can use either TCP or UDP as transport. Normally, all users have access to use all devices without restriction.

Configuration

Step 1 - On the Nodegrid side:

1. Login in as admin into Nodegrid and go to Security.

2. Select Authentication and click Add.

3. Select Radius as method and enter the IP address of remote server.
   

4. Enter IP address of Radius accounting server.

5. Enter the secret key and confirm it.

6. Select Fallback if denied access option.

7. Click Save.

   NOTE:

   The "Fall-back if denied access" option enables you to log-in to the Nodegrid with local accounts in case you cannot authenticate with the Radius users.

   In the case there is no accounting server on the Radius side, it is recommended to leave the field 'Accounting Server' above empty (i.e. no IP address).

8. Go back to Security and select Services.

9. Look in to Manage devices portion and select Device access enforced via user group authentication option.

10. Click Save.

Log in as a user and one can see that user does not have access to any devices. To give access to a user:

1. Log in as admin and go to Security.

2. Select Authorization and select the group needed and click Add.

3. Enter the user one wants to add. If more users needs to be added then separate each username with a comma.

4. Click Save.

Log in back as user and one can see that user will have access to devices allowed by the group.

To match the Radius group, Go to Security :: Authorization, select or create a new group. In Profile, assign the permissions of that group. In Remote Groups, enter the name of group as per declared on the Radius server.

Step 2 - On the RADIUS server side

In this example, the free radius server (opensource) is used. It is assumed that the free radius server is installed.

1. Go to the location /etc/freeradius/3.0/clients.conf.

2. Declare the Nodegrid, following the format:

   client your_nodegrid_device {
       ipaddr = 10.10.10.6
       secret = your_secret_password
       require_message_authenticator = no
       nastype = other
   }

   The secret must match the secret entered, during the first step, on the Nodegrid side.

3. Create the file "usr/share/freeradius/dictionnary.zpe" with the content listed below:
   VENDOR ZPE 42518

   BEGIN-VENDOR ZPE

          ATTRIBUTE ZPE-User-Groups 1 string

   END-VENDOR ZPE

4. Edit the file "usr/share/freeradius/dictionnary".

5. Add a line with the dictionary.zpe:
   $INCLUDE dictionary.zpe

6. Then, in /etc/freeradius/users, assign user groups.

7. Define the "Framed-Filter-ID" attribute (as before) or define a new attribute "ZPE-User-Groups".
   user_radius Cleartext-Password := "password_user_radius"

          ZPE-User-Groups = "radius_network_admin"

   Restart the radius server: systemctl restart freeradius

NOTE: If both attributes are defined, "ZPE-User-Groups" takes precedence:

Troubleshooting

1. Make a local test, on the Radius server, with the command:

   radtest user_radius password_user_radius localhost 0 your_secret_password

2. Log in to the Nodegrid, using the Radius user of the Radius group:

The permissions of that user shall match the ones of the local and associated group.

Method: TACACS+

1. Enter Accounting Server.
   

2. Select Authorize users authenticated with ssh public key checkbox.

3. Enter TACACS+ Port (default: 49).

4. On Service drop-down, select one (PPP, Shell, raccess) (default: raccess).

5. Enter Secret and Confirm Secret.

6. Enter Timeout (default: 2).

7. Enter Retries (default: 2).

8. On TACACS+ Version drop-down, select one (V0, V1, V0_V1, V1_V0) (default: V1).

9. Enter Enforce Source IP for AAA authentication (available in v5.8+).

10. Select Enable User-Level attribute of Shell and raccess services association to local authorization group checkbox (expands dialog with 15 User Levels).
    Per instruction, “Enter local authorization group name for each User Level.”

Method: Kerberos

1. Enter Realm Domain Name.
   

2. Enter Domain Name.

Configure 2-Factor Authentication for Admin/Root Users

1. Go to Security :: Authentication :: Servers.

2. In Index column, click the index to be updated (displays dialog).
   

   

3. Select Apply 2-Factor Authentication for Admin and Root users checkbox (if not selected, Admin and Root roles can use single logon).

4. Click Save.

Edit a Server

1. Go to Security :: Authentication :: Servers.

2. In Index column, click the index to be updated (displays dialog).

3. Make changes, as needed.

4. Click Save.

Delete a Server

1. Go to Security :: Authentication :: Servers.

2. Locate and select checkbox.

3. Click Delete.

4. On the confirmation dialog, click OK.

Move Index Priority Up

1. Go to Security :: Authentication :: Servers.

2. Locate and select checkbox.

3. Click Up to move the selection up in the table.

4. Click Save.

Move Index Priority Down

1. Go to Security :: Authentication :: Servers.

2. Locate and select checkbox.

3. Click Down to move the selection down in the table.

4. Click Save.

Enable/disable Console Authentication

1. Go to Security :: Authentication :: Servers.

2. Locate and select checkbox).

3. Click Console (displays dialog).

   

4. Select Enable Admin and Root users Fallback to Local Authentication on Console checkbox.

5. Click Save.

Set Default Group

1. Go to Security :: Authentication :: Servers.

2. Locate and select checkbox.

3. Click Default Group (displays dialog). 

   

4. On Default Group for Remote Server drop-down, select one.

5. Click Save.

Set Realms 

(available in v5.6+)

Realms allow the user to select authentication server when logging in with the notation user@server or server\user.

1. Go to Security :: Authentication :: Servers.

2. Locate and select checkbox.

3. Click Realms (displays dialog). 

   

4. Select Enable Authentication Server Selection Based on Realms checkbox.

5. Click Save.