Chapter 10: Managing the RADIUS Servers
Overview of the SafeWord RADIUS server
219
identical treatment with regard to network authorization. For example, a
company with 500 employees may have a group of 40 salespersons that all
need permission to dial into the corporate network via modem, and that all
need access to the computer hosting the sales database. This group mech-
anism allows all 40 of those salespersons to be assigned to the sales group
and to be administered simultaneously. Any administrative change to the
definition of the sales record will immediately affect all 40 sales users.
•
User-specific attributes support
Some RADIUS attributes are closely associated with a specific user, and do
not lend themselves well to administration as part of a large group of users.
For example, it may be desirable to assign a specific IP address to a spe-
cific person every time he or she is attached to the Internet. The RADIUS
Server supports user-specific RADIUS attributes matching a user or group
name in the user’s file. This user-specific mechanism allows administrators
to store arbitrary RADIUS attributes directly inside the return field of the
appropriate ACL entry.
•
CHAP support
Administrators can manage CHAP authenticators in the same way they
support all other authenticator types.
•
Vendor-Specific Attributes support
The RADIUS Server provides full support for Vendor-Specific Attributes
(VSAs) in accordance with the provisions of RFC 2138. VSAs allow ven-
dors of routers, communication servers, or other RADIUS-compatible cli-
ents to take full advantage of the unique features of their equipment. Under
the provisions of the current RADIUS protocol, any vendor can teach his
RADIUS-compatible client equipment to accept and carry out one or more
vendor-specific commands through the RADIUS protocol.
The RADIUS Server is capable of sending any RADIUS-compliant VSA to
any RADIUS client after authentication, whenever the data associated with
an authenticated user references a VSA.
•
RADIUS Proxy support
The RADIUS Server was enhanced with the ability to support informal
“RADIUS proxy forwarding”.
•
RADIUS accounting support
The RADIUS protocol includes provisions for storing messages from
RADIUS clients. These are generally used to keep records of network
access activity for accounting purposes. The RADIUS Server can store
these messages in a file for offline analysis.
•
Extensive diagnostics level
The RADIUS Server provides extensive diagnostic levels to help trouble-
shoot RADIUS authentication sessions.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
