HP (Hewlett-Packard) T1428-90026 manual

HP-UX AAA Server A.06.00 Getting Started Guide HP-UX 11.0, 11i v1 Manufacturing P art Number: T1428-90026 E0403 U .S .A. © Copyright 2003 Hewlett-P ackard Company . .[...]

ii Legal Notices The information in this document is subject to change without notice . Hewlett-P ackard makes no warranty of any kind with regard to this manual, including , but not limited to , the implied warranties of merchantability and fitness f or a particular purpose . Hewlett-Pac kard shall not be held liable for errors contained herein o[...]

Contents iii About This Document 1. Introduction to AAA Server RADIUS Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 RADIUS T opology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Establishing a RADIUS Session . . [...]

Contents iv Commands , Utilities, & Daemons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 T esting the Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 3. Basic Configuration T asks Storing User Profiles . . . . . . . . . . . . . . . . . [...]

v About This Document This document provides an overview of the HP-UX AAA Server product and explains how to install it. The document also provides basic configuration steps to beginning tasks. The document printing date and part number indicate the document’s current edition. The printing date and part number will change when a new edition is p[...]

vi • “ About This Document” content w as removed from Chapter 1 in the previous version of this guide, and now resides in the preface of this guide. Publishing History The following table shows the printing history of this document. The first entry in the table corresponds to this document, while previous releases are listed in descending or[...]

vii NO TE Emphasizes or supplements parts of the text. Y ou can disregard the information in a note and still complete a task. IMPORT ANT Notes that provide information that are essential to completing a task. CA UTION Describes an action that must be avoided or followed to prevent a loss of data. Related Documents In addition to this Getting Start[...]

viii Please send comments to: netinfo_feedback@cup .hp.com Please include document title , manufacturing part number , and any comment, error found, or suggestion for improvement you have concerning this document. Also, please inc lude what we did right so we can incorporate it into other documents.[...]

Chapter 1 1 1 Introduction to AAA Server This chapter contains an overview of product features and basic information about using the HP-UX AAA Server .[...]

Introduction to AAA Ser ver RADIUS Overview Chapter 1 2 RADIUS Overview The Remote Authentication Dial In User Service (RADIUS) protocol is widely used and implemented to manage access to network services. It defines a standard for information exchange between a Network Access Server (NAS) and an authentication, authorization, and accounting (AAA)[...]

Introduction to AAA Server RADIUS Overview Chapter 1 3 Figure 1-1 Generic AAA Network T opology AAA4.ISP.net location: Detroit NAS1 NAS2 NAS3 NAS4 location: Ann Arbor AAA1.ISP.net AAA2.ISP.net location: Flint AAA3.ISP.net location: Kalamazoo Repository Repository Repository Repository Organization F User E User Organization Organization D User C Us[...]

Introduction to AAA Ser ver RADIUS Overview Chapter 1 4 Establishing a RADIUS Session The handling of a user request is series of message exchanges that attempts to provide the user with a network service by establishing a session for the user . This transaction can be described as a series of actions that exchange data packets containing informati[...]

Introduction to AAA Server RADIUS Overview Chapter 1 5 If all conditions are met, the server will send an Access-Accept packet to the client; otherwise , the server will send an Access-Reject. An Access-Accept data packet often includes authorization information that specifies what services the user can access and other session information, such a[...]

Introduction to AAA Ser ver RADIUS Overview Chapter 1 6 which can calculate the correct response . The NAS will then forward the challenge and the response in the Access-Request, which the AAA server will use to authenticate the user . • Microsoft Challenge-Handshake Authentication Protocol (MS-CHAP) is an implementation of the CHAP protocol that[...]

Introduction to AAA Server RADIUS Overview Chapter 1 7 Shared Secret Encrypting the transmission of the User-P assword in a request is accomplished by a shared secret. The shared secret is used to sign RADIUS data packets to ensure they are coming from a trusted source . The shared secret is also used to encrypt user passwords with certain authenti[...]

Introduction to AAA Ser ver Product Structure Chapter 1 8 Product Structure The HP-UX AAA Server , based on a client/server architecture , consists of three components which may be installed independently: • HP-UX AAA Server daemon, libraries, and utilities • The AAA Server Manager is a program that performs administration and configuration ta[...]

Introduction to AAA Server Product Structure Chapter 1 9 AAA Server Manager Program The AAA Server Manager utilizes the HP-UX T omcat-based Serverlet Engine to provide a configuration interface between a web browser and one or more AAA servers . Server Manager is used for starting, stopping , configuring , and modifying the servers. In addition, [...]

Introduction to AAA Ser ver Product Structure Chapter 1 10 Figure 1-3 The Server Manager User Interface Browser Requirements for Server Manager Y ou need one of the following W eb browsers to access the Server Manager: • Netscape® Navigator 4.76 (or higher) • Microsoft® Internet Explorer 5.0.5 (or higher) The browser preferences or Internet o[...]

Introduction to AAA Server AAA Server Architecture Chapter 1 11 AAA Server Architecture The HP-UX AAA Server Architecture consists of three primary components: • Configuration files . By editing these flat text files, with either the Server Manager user interface or with a text editor , you can provide the information necessary for the server[...]

Introduction to AAA Ser ver AAA Server Architecture Chapter 1 12 users Information about user IDs, passwords , and check/deny/reply items . realm The same information as the users file , but this user information is associated with a particular realm. These files are only necessary to perform File type authentication for a defined realm. Realms [...]

Introduction to AAA Server AAA Server Architecture Chapter 1 13 Y ou can find out more information about these files by referring to the HP-UX AAA Server Administration and Authentication Guide . Eac h configuration file also contains comments with examples . AA TV Plug-Ins Define actions to perform functions, suc h as authenticating requests,[...]

Introduction to AAA Ser ver HP-UX AAA Server Features Chapter 1 14 HP-UX AAA Server F eatures General F eatures • Compliant with RADIUS protocol RFC 2865 and 2866 standards • Supports multiple vendor NASs with a single server (multi-vendor dictionary that includes Nortel®, Cisco®, Lucent®, and others) • Configurable dictionary that allows[...]

Introduction to AAA Server HP-UX AAA Server Features Chapter 1 15 • Authentication of users defined in a /etc/passwd file • Authentication using multiple sets of user definition and realm definition files ( users and authfile files) keyed by network access server (NAS) • Supports multiple user definition ( realm ) files keyed by realm[...]

Introduction to AAA Ser ver HP-UX AAA Server Features Chapter 1 16 • Supports distributed accounting (proxy) by realms (RADIUS type authentication) • Merit format accounting session record reading utility included ( radrecord ) Admin and Debug T ools/F eatures • Server Manager Graphical User Interface (GUI) for managing multiple AAA servers ?[...]

Chapter 2 17 2 Installation This chapter leads you through the steps to install the HP-UX AAA Server .[...]

Installation System Requirements Chapter 2 18 System Requirements T o install and use this software , the following system specifications are recommended: • HP-UX 11.0 or 11i version 1UNIX operating systems • Disk space: Operational requirements depend on the amount of logging information to be maintained online. W ith a moderate dial-in load,[...]

Installation System Requirements Chapter 2 19 • Compaq/DEC • Livingston/Lucent • Shiva/Intel • T elebit • Unisphere • US Robotics/3COM LAN Access Device Compatibility The HP-UX AAA Server supports LAN switches and wireless LAN Access points that follow the IETF standard for EAP with MD5, as well as devices supporting the Cisco proprieta[...]

Installation Obtaining the HP-UX AAA Server Software Chapter 2 20 Obtaining the HP-UX AAA Server Software Y ou can download the HP-UX AAA Server software at http://software .hp.com on the Internet and Security Solutions page. Product Dependencies The following figure shows the components you must install to use the HP-UX AAA Server: Figure 2-1 HP-[...]

Installation Product Dependencies Chapter 2 21 Y ou must have the following two softw are dependencies installed on your system to use the HP-UX AAA Server: • HP-UX SDK (product #T1456AA) containing Ja va2 RTE 1.4.0.x • HP-UX T omcat-based Serverlet Engine v 1.0.00.01 (product # HPUXWST100001) or higher Y ou can get HP-UX SDK with J ava2 RTE 1.[...]

Installation Installation and Start-Up Overview Chapter 2 22 Installation and Start-Up Overview The information in this section is to help you understand the sequence of the installation and start-up steps, and the relationship between the product dependencies and the HP-UX AAA Server software . The following steps are an overview of the installati[...]

Installation Installation and Start-Up Procedure Chapter 2 23 Installation and Start-Up Procedure The following components are installed when you install the HP-UX AAA Server: • AAA Server binaries , libraries, and utilities • RMI objects that facilitate communication from the AAA server to Server Manager • AAA server AATV module for authenti[...]

Installation Installation and Start-Up Procedure Chapter 2 24 NO TE If the installation is not successful, an error message is displayed. The cause of the failure will appear at the end of /var/adm/sw/swagent.log file. Step 9. After installing the product, you will need to add the following RADIUS authentication and accounting entries to the /etc/[...]

Installation Installation and Start-Up Procedure Chapter 2 25 Step 12. Uncomment the following lines in /opt/hpws/tomcat/conf/web.xml : Commented <!-- The mapping for the invoker servlet --> <!-- <servlet-mapping> <servlet-name>invoker</servlet-name> <url-pattern>/servlet/*</url-pattern> </servlet-mapping&g[...]

Installation Running Server Manager Chapter 2 26 Running Server Manager The RMI objects must be started from the command line before HP-UX AAA Servers can be started, stopped, and configured through the Server Manager interface. Start the RMI objects to allow AAA Servers to communicate with the Server Manager . Start the Server Manager to allow th[...]

Installation Running Server Manager Chapter 2 27 Changing Server Manager User Name and P assword Y ou can change the user name or password used to access the Server Manager graphic interface. Step 1. Go to /opt/hpws/tomcat/conf/tomcat-users.xml Step 2. Change the following values to configure different user names and passwords: <user name=“Ne[...]

Installation UnInstalling the HP-UX AAA Server Software Chapter 2 28 UnInstalling the HP-UX AAA Server Software Use the following steps to uninstall the HP-UX AAA Server: Step 1. If the radiusd and db_srv servers are running, stop the servers . Use the following commands to determine if radiusd or db_srv processes are active: $ ps -ef |grep radiusd[...]

Installation Installation Defaults Chapter 2 29 Installation Defaults The HP-UX AAA Server can be run as root user , however non-root user is recommended. A user and group, both named aaa , will be created during installation. The HP-UX AAA Server can be run as non-root user , using the default aaa user created during installation, or any other use[...]

Installation Installation Defaults Chapter 2 30 /opt/aaa/examples/ config Finite state machine , group policy example files: • *.fsm : sample finite state machine (FSM) tables • *.grp : sample decision files /opt/aaa/examples/ oracle • create.sql : SQL script to create Oracle users table • delete.sql : Sample SQL script to delete Oracle [...]

Installation Installation Defaults Chapter 2 31 /etc/opt/aaa Configuration files: • aaa.config : runtime and tunneling configuration file • authfile : realm to authentication-type mapping file • clients : client to shared secret mapping file • db_srv.opt : configuration script for db_srv environment variables • dictionary : defini[...]

Installation Installation Defaults Chapter 2 32 The following table lists the files generated during operation and located in /var/opt/aaa/ by default: T able 2-2 Files Generated During Operation Directory File /acct/session.yyyy-mm-dd.log Default session accounting logs, Merit style /data/session.las Currently active sessions Session log file /i[...]

Installation Commands, Utilities, & Daemons Chapter 2 33 Commands, Utilities, & Daemons T able 2-3 Commands, Utilities, & Daemons Command Description db_srv The db_srv daemon performs Oracle database access operations for authentication on behalf of one or more remote HP-UX AAA Servers . radcheck Sends a RADIUS status and protocol reque[...]

Installation Commands, Utilities, & Daemons Chapter 2 34 stop_db_srv.sh Script to stop db_srv daemon and its child process(es). stopsession.sh Script to manually stop an accounting session. las .test.sh Script to create simulated sessions for testing. T able 2-3 Commands, Utilities, & Daemons (Continued) Command Description[...]

Installation T esting the Installation Chapter 2 35 T esting the Installation T o quickly test the server installation, you will use Server Manager to add a loopback connection to a AAA server , start the server , and then check its status for a response . Use the following steps to test the server installation: Step 1. F ollow the directions for ?[...]

Installation T esting the Installation Chapter 2 36[...]

Chapter 3 37 3 Basic Configuration T asks This chapter explains a few basic configuration tasks . Refer to the HP-UX AAA Server Administration and Authentication Guide for complete information on configuring the HP-UX AAA Server .[...]

Basic Configuration T asks Storing User Profiles Chapter 3 38 Storing User Profiles The user information that determines how an access request is authenticated and authorized is configured in a profile as a set of A-V pairs . These user profiles are grouped by realm and may be stored in flat text files or an external source such as an Oracl[...]

Basic Configuration T asks Storing User Profiles Chapter 3 39 CA UTION Save Configuration will save the entire server configuration (access devices, proxies , local realms, users , and server properties) to the servers you specify . Storing Wireless User Profiles Locally If you want to authenticate users with EAP , you will need to identify th[...]

Basic Configuration T asks Storing User Profiles Chapter 3 40 Step 12. Complete any of the remaining optional fields as necessary for your configuration. Step 13. Select the Create button. Step 14. Repeat steps 8 to 13 for each user profile that you need to configure. Step 15. F or each realm using EAP , you must associate the realm name with[...]

Basic Configuration T asks Storing User Profiles Chapter 3 41 Grouping Users by Realm While the HP-UX AAA Server can authenticate an individual user , you may w ant to authenticate and provision a group of users according to a common criteria, like an authentication type. One method of grouping users is according to the realm that they belong to.[...]

Basic Configuration T asks Storing User Profiles Chapter 3 42 Step 12. Y ou may enter values in the remaining fields to control the users session. These fields are optional and correspond to RADIUS A-V pairs that are explained in more detail in the “ A-V P airs” chapter of HP-UX AAA Server Administration and Authentication Guide . Step 13. [...]

Basic Configuration T asks Adding and Modifying Users Chapter 3 43 Adding and Modifying Users User profiles associate information with a user name for authentication and authorization. This information is defined by attribute-value pairs . The server configuration must include profiles for all the users that can access services through the AAA[...]

Basic Configuration T asks Adding and Modifying Users Chapter 3 44 User Name: V alue to compare to the User-Name attribute value in the request. It must be less than 64 characters . &, “, ~, , /,%, $, ‘, and space characters may not be used. The remaining fields and tabs in Define Users screen allow you to specify three types of user pr[...]

Basic Configuration T asks Adding and Modifying Users Chapter 3 45 Figure 3-2 Server Manager’ s Free User Attributes Screen T o add attributes to the list boxes , follow the Attribute = V alue syntax. A-V pairs may be listed one per line . When adding a new user profile, you select the Create button to submit it to the AAA Server Manager . When[...]

Basic Configuration T asks Session Logging and Monitoring Chapter 3 46 Session Logging and Monitoring Y ou can view the log files that record the details of each AAA transaction or the session logs that record information about each user's session. Y ou can also access information for active sessions and manually terminate a session if neces[...]

Basic Configuration T asks Session Logging and Monitoring Chapter 3 47 Step 3. Select the Display button. The AAA server manager will display a list of active sessions. Step 4. Select a session. The AAA server manager will display the attributes for the selected session. Step 5. Select the OK button when you are done reading the session. Stopping [...]

Basic Configuration T asks Session Logging and Monitoring Chapter 3 48 Viewing Server Logfiles The log file of the AAA server contains all the information concerning the functioning of the server such as: start/stop of the server , all of the RADIUS requests , and some internal events. The data is automatically stored each day in a different fi[...]

Basic Configuration T asks Session Logging and Monitoring Chapter 3 49 Search P arameters Y ou can filter what dates and times to retrieve from the logfile. NO TE Y ou can filter what data to retrieve according to the type of messages. F or each message type , you indicate whether the message type should or should not be retrieved by selecting [...]

Basic Configuration T asks Session Logging and Monitoring Chapter 3 50 Viewing Server Statistics Selecting the Statistics link from Server Manager’ s Navigation Tree allows you to retrieve a count of events that occurred on the AAA server within a time range. The statistics are displa yed using a bar graph. Figure 3-5 Server Manager’ s Statist[...]

Glossary of T erms Chapter 4 51 4 Glossary of T erms AAA Abbreviation for Authentication, Authorization, and Accounting . AAA Server A software application that performs authentication, authorization, and accounting functions. Accounting Logging session and usage information for session control and billing purposes Access-Accept The AAA server retu[...]

Glossary of T erms Chapter 4 52 Administrator Special user , known by the system on which the AAA server is running and is able to configure and to manage the AAA server . Application Service Provider Third-party entities that manage and distribute software-based services and solutions to customers across a wide area network from a central data ce[...]

Glossary of T erms Chapter 4 53 sent back to the server . The server does the same with its copy of the password and verifies that it gets the same result to authenticate the user , abbreviated as CHAP . CHAP See Challenge Handshake Authentication Protocol . Client NAS , proxy server , or other networking device that uses the AAA server services t[...]

Glossary of T erms Chapter 4 54 The AAA server that receives an Access-Request from a client and forwards that request to another AAA server for authentication. FSM See Finite State Mac hine . Hint When a user requests access to a service of a specific configuration, a client may provide this information in an Access-Request as a hint to the AAA [...]

Glossary of T erms Chapter 4 55 Communications service company that provides Internet access and services to its customers. ISPs range in size from small independents serving a local calling area to large, established telecommunications companies, abbreviated as ISP . IP See Internet Protocol . IRTF See Internet Research T ask F orce . ISP Internet[...]

Glossary of T erms Chapter 4 56 Microsoft Challenge-Handshake Authentication Protocol (MS-CHAP) An implementation of the CHAP protocol that Microsoft created to authenticate remote Windows workstations. In most respects , MS-CHAP is identical to CHAP , but there are a few differences. MS-CHAP is based on the encryption and hashing algorithms used b[...]

Glossary of T erms Chapter 4 57 decisions that control the authentication, authorization, and accounting process for a user's access request. PPP See P oint-to-P oint Protocol . Protocol A set of rules established between two devices to allow communications to occur . Proxy The mechanism that allows one system to mediate between two other syst[...]

Glossary of T erms Chapter 4 58 requests . A realm has a name that looks very much like a domain name, but they bear different meanings . Realms are only used by the AAA Server to determine where an authentication request should be sent and what kind of authentication to request, etc. Naming a realm with its domain name simplifies things for the u[...]

Glossary of T erms Chapter 4 59 access the server’s status and system time , retrieve information from accounting and session logs , and terminate sessions. Service The RADIUS client provides a service to the dial-in user , such as PPP or T elnet.[...]

Glossary of T erms Chapter 4 60 Session Each service provided by the client to a dial-in user constitutes a session, with the beginning of the session defined as the point where service is first provided and the end of the session defined as the point where service is ended. A user may have multiple sessions in parallel or series if the RADIUS c[...]

Glossary of T erms Chapter 4 61 initiated by the client or a compulsory tunnel initiated during authentication by a server or other dedicated network equipment. Users Individuals whom the AAA server must authenticate and authorize before by they can access an organization’s service , such as Internet access through an ISP . VPN See V irtual Priva[...]

Glossary of T erms Chapter 4 62[...]