HP StorageWorks Fabric OS 5.3.x administrator guide (5697-0244, November 2009)

78 Managing user accounts
FreeRADIUS installation places the configuration files in $PREFIX/etc/raddb . By default, the PREFIX is
/usr/local.
Configuring RADIUS service on Linux consists of the following tasks:
• Adding the Brocade attribute to the server
• Creating the user
• Enabling clients
How to add the Brocade attribute to the server
1. Create and save the file $PREFIX/etc/raddb/dictionary.brocade with the following
information:
This defines the Brocade vendor ID as 1588, the Brocade attribute 1 as Brocade-Auth-Role, and it is a
string value.
2. Open the file $PREFIX/etc/raddb/dictionary in a text editor and add the line:
As a result, the file
dictionary.brocade is located in the RADIUS configuration directory., and loaded for
use by the RADIUS server.
How to create the user
1. Open the $PREFIX/etc/raddb/user file in a text editor and add user names and roles for users
who will be accessing the switch and authenticating RADIUS.
The user will log in using the role specified with Brocade-Auth-Role. The valid roles include Root,
Factory, Admin, SwitchAdmin, and User. The new roles appearing in 5.2.x are also valid. You must use
quotation marks around “password” and “role”.
For example, to set up an account called JohnDoe with the Admin role:
The next example uses the local system password file to authenticate users.
When you use NIS for authentication, the only way to enable authentication with the password file is to
force the switch to authenticate using PAP; this requires the
-a pap option with the aaaConfig
command.
Clients are the switches that will be using the RADIUS server; each client must be defined. By default, all IP
addresses are blocked.
On dual-CP switches (SAN Director 2/128 and 4/256 Director), the switch sends its RADIUS request using
the IP address of the active CP. When adding clients, add both the active and standby CP IP addresses so
that users can still log in the event of a failover.
How to enable clients
1. Open the $PREFIX/etc/raddb/client.config file in a text editor and add the switches that are
to be configured as RADIUS clients.
#
# Brocade FabricOS v5.0.1 dictionary
#
VENDOR Brocade 1588
#
# attribute 1 defined to be Brocade-Auth-Role
# string defined in user configuration
#
ATTRIBUTE Brocade-Auth-Role 1 string Brocade
$INCLUDE dictionary.brocade
JohnDoe Auth-Type := Local, User-Password == “johnPassword” Brocade-Auth-Role =
“admin”
JohnDoe Auth-Type := System, Brocade-Auth-Role = “admin”