Page 2 - ii; Legal Notices; is a U.S. registered trademark of Microsoft
ii Legal Notices The information in this document is subject to change without notice.Hewlett-Packard makesno warranty of any kind with regard to this manual, including, but not limited to, the impliedwarranties of merchantability and fitness for a particular purpose. Hewlett-Packard shall notbe hel...
Page 3 - Contents; iii; About This Document
Contents iii About This Document 1. Introduction to AAA Server RADIUS Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 RADIUS Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....
Page 4 - iv; Basic Configuration Tasks
Contents iv Commands, Utilities, & Daemons . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33Testing the Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 3. Basic Configuration Tasks Storing User...
Page 5 - The latest version of this document can be found at; Intended Audience; . See “Product Dependencies” for more
v About This Document This document provides an overview of the HP-UX AAA Server productand explains how to install it. The document also provides basicconfiguration steps to beginning tasks. The document printing date and part number indicate the document’scurrent edition. The printing date and par...
Page 6 - Typographical Conventions; monospace
vi • “About This Document” content was removed from Chapter 1 in theprevious version of this guide, and now resides in the preface of thisguide. Publishing History The following table shows the printing history of this document. The firstentry in the table corresponds to this document, while previou...
Page 7 - Related Documents; on the; HP Encourages Your Comments; Table 2
vii NOTE Emphasizes or supplements parts of the text. You can disregard theinformation in a note and still complete a task. IMPORTANT Notes that provide information that are essential to completing a task. CAUTION Describes an action that must be avoided or followed to prevent a loss of data. Relate...
Page 8 - viii
viii Please send comments to: [email protected] Please include document title, manufacturing part number, and anycomment, error found, or suggestion for improvement you haveconcerning this document. Also, please include what we did right so wecan incorporate it into other documents.
Page 9 - Chapter 1; Introduction to AAA Server
Chapter 1 1 1 Introduction to AAA Server This chapter contains an overview of product features and basicinformation about using the HP-UX AAA Server.
Page 10 - RADIUS Overview; RADIUS Topology
Introduction to AAA Server RADIUS Overview Chapter 1 2 RADIUS Overview The Remote Authentication Dial In User Service (RADIUS) protocol iswidely used and implemented to manage access to network services. Itdefines a standard for information exchange between a Network AccessServer (NAS) and an authen...
Page 12 - Establishing a RADIUS Session; Client-Server RADIUS Transaction
Introduction to AAA Server RADIUS Overview Chapter 1 4 Establishing a RADIUS Session The handling of a user request is series of message exchanges thatattempts to provide the user with a network service by establishing asession for the user. This transaction can be described as a series ofactions th...
Page 13 - Supported Authentication Methods
Introduction to AAA Server RADIUS Overview Chapter 1 5 If all conditions are met, the server will send an Access-Accept packet tothe client; otherwise, the server will send an Access-Reject. AnAccess-Accept data packet often includes authorization information thatspecifies what services the user can...
Page 14 - RADIUS Data Packets
Introduction to AAA Server RADIUS Overview Chapter 1 6 which can calculate the correct response. The NAS will then forwardthe challenge and the response in the Access-Request, which theAAA server will use to authenticate the user. • Microsoft Challenge-Handshake Authentication Protocol(MS-CHAP) is a...
Page 15 - Shared Secret; clients
Introduction to AAA Server RADIUS Overview Chapter 1 7 Shared Secret Encrypting the transmission of the User-Password in a request isaccomplished by a shared secret. The shared secret is used to signRADIUS data packets to ensure they are coming from a trusted source.The shared secret is also used to...
Page 16 - Product Structure; AAA Server module for Oracle authentication; NOTE; AAA Servers
Introduction to AAA Server Product Structure Chapter 1 8 Product Structure The HP-UX AAA Server, based on a client/server architecture, consists ofthree components which may be installed independently: • HP-UX AAA Server daemon, libraries, and utilities • The AAA Server Manager is a program that per...
Page 17 - AAA Server Manager Program
Introduction to AAA Server Product Structure Chapter 1 9 AAA Server Manager Program The AAA Server Manager utilizes the HP-UX Tomcat-based ServerletEngine to provide a configuration interface between a web browser andone or more AAA servers. Server Manager is used for starting, stopping,configuring,...
Page 19 - AAA Server Architecture; text file. The state table outlines what; Configuration Files; HP-UX AAA Server Configuration Files
Introduction to AAA Server AAA Server Architecture Chapter 1 11 AAA Server Architecture The HP-UX AAA Server Architecture consists of three primarycomponents: • Configuration files. By editing these flat text files, with either theServer Manager user interface or with a text editor, you can providet...
Page 21 - The Software Engine: Finite State Machine; The configuration script for the
Introduction to AAA Server AAA Server Architecture Chapter 1 13 You can find out more information about these files by referring to theHP-UX AAA Server Administration and Authentication Guide. Eachconfiguration file also contains comments with examples. AATV Plug-Ins Define actions to perform functi...
Page 22 - HP-UX AAA Server Features; General Features
Introduction to AAA Server HP-UX AAA Server Features Chapter 1 14 HP-UX AAA Server Features General Features • Compliant with RADIUS protocol RFC 2865 and 2866 standards • Supports multiple vendor NASs with a single server (multi-vendordictionary that includes Nortel®, Cisco®, Lucent®, and others) •...
Page 23 - users; Authorization Features
Introduction to AAA Server HP-UX AAA Server Features Chapter 1 15 • Authentication of users defined in a /etc/passwd file • Authentication using multiple sets of user definition and realmdefinition files ( users and authfile files) keyed by network access server (NAS) • Supports multiple user defini...
Page 24 - radrecord; Admin and Debug Tools/Features; radpwtst
Introduction to AAA Server HP-UX AAA Server Features Chapter 1 16 • Supports distributed accounting (proxy) by realms (RADIUS typeauthentication) • Merit format accounting session record reading utility included( radrecord ) Admin and Debug Tools/Features • Server Manager Graphical User Interface (G...
Page 25 - Chapter 2; Installation
Chapter 2 17 2 Installation This chapter leads you through the steps to install the HP-UX AAAServer.
Page 26 - System Requirements; HP-UX 11.0 or 11i version 1UNIX operating systems; IMPORTANT; NAS Compatibility; Avail
Installation System Requirements Chapter 2 18 System Requirements To install and use this software, the following system specifications arerecommended: • HP-UX 11.0 or 11i version 1UNIX operating systems • Disk space: Operational requirements depend on the amount oflogging information to be maintain...
Page 27 - Telebit; LAN Access Device Compatibility
Installation System Requirements Chapter 2 19 • Compaq/DEC • Livingston/Lucent • Shiva/Intel • Telebit • Unisphere • US Robotics/3COM LAN Access Device Compatibility The HP-UX AAA Server supports LAN switches and wireless LANAccess points that follow the IETF standard for EAP with MD5, as wellas dev...
Page 28 - Obtaining the HP-UX AAA Server Software; HP-UX AAA Server Dependencies; HTTP or; AAA Software
Installation Obtaining the HP-UX AAA Server Software Chapter 2 20 Obtaining the HP-UX AAA Server Software You can download the HP-UX AAA Server software athttp://software.hp.com on the Internet and Security Solutions page. Product Dependencies The following figure shows the components you must insta...
Page 29 - Product Dependencies
Installation Product Dependencies Chapter 2 21 You must have the following two software dependencies installed on yoursystem to use the HP-UX AAA Server: • HP-UX SDK (product #T1456AA) containing Java2 RTE 1.4.0.x • HP-UX Tomcat-based Serverlet Engine v 1.0.00.01 (product #HPUXWST100001) or higher Y...
Page 30 - Installation and Start-Up Overview; and Security Solutions page at
Installation Installation and Start-Up Overview Chapter 2 22 Installation and Start-Up Overview The information in this section is to help you understand the sequence ofthe installation and start-up steps, and the relationship between theproduct dependencies and the HP-UX AAA Server software. The fo...
Page 31 - Installation and Start-Up Procedure; AAA Server binaries, libraries, and utilities; Step 2. Verify the product dependencies are installed:; and; Step 6. Verify you downloaded the file correctly:
Installation Installation and Start-Up Procedure Chapter 2 23 Installation and Start-Up Procedure The following components are installed when you install the HP-UXAAA Server: • AAA Server binaries, libraries, and utilities • RMI objects that facilitate communication from the AAA server toServer Mana...
Page 33 - . Add your user name and; and log on to
Installation Installation and Start-Up Procedure Chapter 2 25 Step 12. Uncomment the following lines in /opt/hpws/tomcat/conf/web.xml : Commented <!-- The mapping for the invoker servlet --> <!-- <servlet-mapping> <servlet-name>invoker</servlet-name> <url-pattern>/se...
Page 34 - Running Server Manager; Starting and Stopping the RMI Objects; cd; Starting and Stopping Server Manager
Installation Running Server Manager Chapter 2 26 Running Server Manager The RMI objects must be started from the command line before HP-UXAAA Servers can be started, stopped, and configured through the ServerManager interface. Start the RMI objects to allow AAA Servers tocommunicate with the Server ...
Page 35 - Changing Server Manager User Name and Password
Installation Running Server Manager Chapter 2 27 Changing Server Manager User Name and Password You can change the user name or password used to access the ServerManager graphic interface. Step 1. Go to /opt/hpws/tomcat/conf/tomcat-users.xml Step 2. Change the following values to configure different...
Page 36 - UnInstalling the HP-UX AAA Server Software; Step 2. Remove all files residing in
Installation UnInstalling the HP-UX AAA Server Software Chapter 2 28 UnInstalling the HP-UX AAA Server Software Use the following steps to uninstall the HP-UX AAA Server: Step 1. If the radiusd and db_srv servers are running, stop the servers. Use the following commands to determine if radiusd or db...
Page 37 - Installation Defaults
Installation Installation Defaults Chapter 2 29 Installation Defaults The HP-UX AAA Server can be run as root user, however non-root user isrecommended. A user and group, both named aaa , will be created during installation. The HP-UX AAA Server can be run as non-root user, using the defaultaaa user...
Page 38 - config; File Locations Upon Installation (Continued)
Installation Installation Defaults Chapter 2 30 /opt/aaa/examples/ config Finite state machine, group policy example files: • *.fsm : sample finite state machine (FSM) tables • *.grp : sample decision files /opt/aaa/examples/ oracle • create.sql : SQL script to create Oracle users table • delete.sql...
Page 39 - authfile
Installation Installation Defaults Chapter 2 31 /etc/opt/aaa Configuration files: • aaa.config : runtime and tunneling configuration file • authfile : realm to authentication-type mapping file • clients : client to shared secret mapping file • db_srv.opt : configuration script for db_srv environment...
Page 40 - ipc
Installation Installation Defaults Chapter 2 32 The following table lists the files generated during operation and locatedin /var/opt/aaa/ by default: Table 2-2 Files Generated During Operation Directory File /acct/session.yyyy-mm-dd.log Default session accounting logs, Merit style /data/session.las...
Page 42 - Script to stop; Command
Installation Commands, Utilities, & Daemons Chapter 2 34 stop_db_srv.sh Script to stop db_srv daemon and its child process(es). stopsession.sh Script to manually stop an accounting session. las.test.sh Script to create simulated sessions for testing. Table 2-3 Commands, Utilities, & Daemons ...
Page 43 - Testing the Installation; Step 3. Enter the values for your server in the; Add Connection; Step 5. Select the Administration link from the Navigation Tree.
Installation Testing the Installation Chapter 2 35 Testing the Installation To quickly test the server installation, you will use Server Manager toadd a loopback connection to a AAA server, start the server, and thencheck its status for a response. Use the following steps to test the serverinstallat...
Page 45 - Chapter 3; Basic Configuration Tasks
Chapter 3 37 3 Basic Configuration Tasks This chapter explains a few basic configuration tasks. Refer to theHP-UX AAA Server Administration and Authentication Guide forcomplete information on configuring the HP-UX AAA Server.
Page 46 - Storing User Profiles; Storing User Profiles in the Default Users File; Load Configuration; Step 3. Select the Users link from the Navigation Tree.; the name of the user profile.
Basic Configuration Tasks Storing User Profiles Chapter 3 38 Storing User Profiles The user information that determines how an access request isauthenticated and authorized is configured in a profile as a set of A-Vpairs. These user profiles are grouped by realm and may be stored in flattext files o...
Page 47 - Storing Wireless User Profiles Locally; Access Devices
Basic Configuration Tasks Storing User Profiles Chapter 3 39 CAUTION Save Configuration will save the entire server configuration (accessdevices, proxies, local realms, users, and server properties) to the serversyou specify. Storing Wireless User Profiles Locally If you want to authenticate users w...
Page 48 - type of EAP to perform. Select the; Step 22. Repeat steps 15 to 21 as necessary for your configuration.; CAUTION; Save Configuration
Basic Configuration Tasks Storing User Profiles Chapter 3 40 Step 12. Complete any of the remaining optional fields as necessary for your configuration. Step 13. Select the Create button. Step 14. Repeat steps 8 to 13 for each user profile that you need to configure. Step 15. For each realm using EA...
Page 49 - Grouping Users by Realm
Basic Configuration Tasks Storing User Profiles Chapter 3 41 Grouping Users by Realm While the HP-UX AAA Server can authenticate an individual user, youmay want to authenticate and provision a group of users according to acommon criteria, like an authentication type. One method of groupingusers is a...
Page 51 - Adding and Modifying Users; Server Manager’s General User Attributes
Basic Configuration Tasks Adding and Modifying Users Chapter 3 43 Adding and Modifying Users User profiles associate information with a user name for authenticationand authorization. This information is defined by attribute-value pairs.The server configuration must include profiles for all the users...
Page 54 - Session Logging and Monitoring; These functions can be accessed by selecting the; Viewing User Session; Navigation Tree located in the left frame of the browser; Sessions Search Filter Screen
Basic Configuration Tasks Session Logging and Monitoring Chapter 3 46 Session Logging and Monitoring You can view the log files that record the details of each AAA transactionor the session logs that record information about each user's session. Youcan also access information for active sessions and...
Page 55 - the selected session.; Step 5. Select the OK button when you are done reading the session.
Basic Configuration Tasks Session Logging and Monitoring Chapter 3 47 Step 3. Select the Display button. The AAA server manager will display a list of active sessions. Step 4. Select a session. The AAA server manager will display the attributes for the selected session. Step 5. Select the OK button ...
Page 56 - Viewing Server Logfiles; : the server log file; Server Manager’s Logfile Screen
Basic Configuration Tasks Session Logging and Monitoring Chapter 3 48 Viewing Server Logfiles The log file of the AAA server contains all the information concerning thefunctioning of the server such as: start/stop of the server, all of theRADIUS requests, and some internal events. The data is automa...
Page 57 - You can filter what dates and times to retrieve from the logfile.; The date and time of the session to begin retrieving data from.
Basic Configuration Tasks Session Logging and Monitoring Chapter 3 49 Search Parameters You can filter what dates and times to retrieve from the logfile. NOTE You can filter what data to retrieve according to the type of messages. Foreach message type, you indicate whether the message type should or...
Page 58 - Viewing Server Statistics; Selecting the; Server Manager’s Statistics Screen
Basic Configuration Tasks Session Logging and Monitoring Chapter 3 50 Viewing Server Statistics Selecting the Statistics link from Server Manager’s Navigation Tree allows you to retrieve a count of events that occurred on the AAA serverwithin a time range. The statistics are displayed using a bar gr...
Page 59 - Chapter 4; Glossary of Terms; AAA
Glossary of Terms Chapter 4 51 4 Glossary of Terms AAA Abbreviation for Authentication, Authorization, andAccounting. AAA Server A software application that performs authentication,authorization, and accounting functions. Accounting Logging session and usage information for sessioncontrol and billin...
Page 67 - Service
Glossary of Terms Chapter 4 59 access the server’s status and system time, retrieveinformation from accounting and session logs, andterminate sessions. Service The RADIUS client provides a service to the dial-inuser, such as PPP or Telnet.
Page 69 - Users
Glossary of Terms Chapter 4 61 initiated by the client or a compulsory tunnel initiatedduring authentication by a server or other dedicatednetwork equipment. Users Individuals whom the AAA server must authenticateand authorize before by they can access anorganization’s service, such as Internet acce...
