How to configure the RADIUS based Login for RUGGEDCOM WIN Base Stations

Size: px

Start display at page:

Download "How to configure the RADIUS based Login for RUGGEDCOM WIN Base Stations"

Gwen Wheeler
6 years ago
Views:

1 FAQ 10/2014 How to configure the RADIUS based Login for RUGGEDCOM WIN Base Stations RUGGEDCOM WIN7000, RUGGEDCOM WIN7200

2 This entry is from the Siemens Industry Online Support. The general terms of use ( apply. Security information Siemens provides products and solutions with industrial security functions that support the secure operation of plants, solutions, machines, equipment and/or networks. They are important components in a holistic industrial security concept. With this in mind, Siemens products and solutions undergo continuous development. Siemens recommends strongly that you regularly check for product updates. For the secure operation of Siemens products and solutions, it is necessary to take suitable preventive action (e.g. cell protection concept) and integrate each component into a holistic, state-of-the-art industrial security concept. Third-party products that may be in use should also be considered. For more information about industrial security, visit To stay informed about product updates as they occur, sign up for a productspecific newsletter. For more information, visit Table of Contents 1 Introduction Notations and Abbreviations General User Types RADIUS based login Configuration Login Local login Appendix A: Adding dictionary file into AAA server Free Radius ACS Aptilo 9.1 SP7/SP Entry-ID: , V 1.0, 10/2014 2

3 1 Introduction 1 Introduction 1.1 Notations and Abbreviations Table 1-1 Notation/ Abbreviation Description BS AAA CPE Base Station Authentication, Authorization and Accounting server Customer Premise Equipment 1.2 General RADIUS based authentication allows user WEB login using the AAA server as Authentication server. This allows managing users for all Base Stations in the operator network using single server. Entry-ID: , V 1.0, 10/2014 3

4 2 User Types 2 User Types There are 3 types of users: Local Admin authenticates using local Base station database, doesn t require AAA server connectivity. Allowed to manage Local Admin database. Remote Admin Authenticates using remote authentication server. Not allowed to manage Local Admin database, in fact the local users will not be shown. Guest Can be either local or remote. A read only user. Can view configuration and clear alarms and statistic. Entry-ID: , V 1.0, 10/2014 4

5 3 RADIUS based login 3 RADIUS based login 3.1 Configuration Login using RADIUS server includes the following configuration: AAA server details at a Base station that includes: Radius login Enables/Disables the feature. Login AAA IP address IP of the AAA server used to authenticate users. It can be the same AAA server as the one used for CPE authentication or a different one. Login AAA Port The default is Login AAA Secret Shared secret between BS and the AAA. BS Configuration on AAA server Common shared secret must be defined. User configuration on AAA server When Configuring user on the AAA a special attribute RuggedComprivilege-Level must be configured,to add that attribute a special dictionary file must be added to the AAA server, please see appendix A for details how to add the dictionary file. There are two options setting this attribute once dictionary file had been added: Admin This user will access the BS as a remote admin user. Guest This user will access the BS as a guest user. The following figure shows the AAA server configurations on the BS. Figure 3-1 Entry-ID: , V 1.0, 10/2014 5

6 3 RADIUS based login 3.2 Login The following figure shows the login screen: Figure 3-2: Login Screen In order to login using AAA RADIUS server exact user name and password should be entered as defined in the AAA server. Entry-ID: , V 1.0, 10/2014 6

7 4 Local login 4 Local login The local login uses the same login screen as a remote login, however for the local login a special added at the end of the username to signal BS that the requested login is for the local database. For example: if the local login is admin, the entered username should be admin@local Entry-ID: , V 1.0, 10/2014 7

8 5 Appendix A: Adding dictionary file into AAA server 5 Appendix A: Adding dictionary file into AAA server 5.1 Free Radius 5.2 ACS 1. Locate the FreeRADIUS dictionary files. Commonly this would be: /usr/share/freeradius/ directory 2. In the dictionary directory, open the file named "dictionary", and add the line: $INCLUDE dictionary.ruggedcom. 3. Copy the dictionary.ruggedcom file to the directory. (You can download the file dictionary.zip from the html page where you can find this document. The dictionary.zip includes the dictionary.ruggedcom file.) 4. Restart the radiusd. 1. If the desired attributes are RUGGEDCOM VSAs, there is a need to create a RUGGEDCOM dictionary in ACS. Please refer to the following screenshot: Figure 5-1 Entry-ID: , V 1.0, 10/2014 8

9 5 Appendix A: Adding dictionary file into AAA server 2. Once you press Create, the relevant attributes can be added to the dictionary. For example, privilege level attribute (for RADIUS-based authentication): Figure Aptilo 9.1 SP7/SP4 1. Enter the Aptilo CLI interface (SSH to the Linux server that Aptilo is running on). 2. If the dictionary file is on USB drive, insert it and do the following in order to mount the disk: Fdisk -1. This will show the USB drive as sdb1 (or something similar) mkdir /mnt/sdb1 mount /dev/sdb1 /mnt/sdb1 3. Now once the USB drive is mounted, it s a regular drive and it s possible to do ls on it and locate the file. 4. Copy the RUGGEDCOM dictionary file to /usr/share/freeradius directory. 5. Locate the file called dictionary in /usr/share/freeradius directory. Edit it with vi and add the following line after all the INCLUDE lines: $INCLUDE dictionary.ruggedcom 6. Perform the aptilo-restart command. Entry-ID: , V 1.0, 10/2014 9

How to manage the X.509 Certificates in RUGGEDCOM WIN BS and CPEs Software Version 4.3 RUGGEDCOM WIN FAQ 10/2014

FAQ 10/2014 How to manage the X.509 Certificates in RUGGEDCOM WIN BS and CPEs Software Version 4.3 RUGGEDCOM WIN http://support.automation.siemens.com/ww/view/en/103158899 This entry is from the Siemens