Avocent CPS810 - Manual (Page 39)

Chapter 3: Operations 25
• Secure indicates authentication will be locked to one DSView software server after a
successful initial access, and DSView software server and appliance credentials will be stored
on the CPS appliance.
• Trustall indicates that any DSView software server may be used for authentication, and
DSView software server credentials will not be stored or validated on the CPS appliance.
When the secure mode is used, you may clear the stored credentials used by the DSView software
at any time.
For more information, see the DSView Installer/User Guide.
Local authentication
Local authentication uses the CPS appliance internal user database to authenticate users.
RADIUS authentication
RADIUS authentication uses an external third party RADIUS server containing a user database to
authenticate CPS network appliance users. The CPS appliance, functioning as a RADIUS client,
sends usernames and passwords to the RADIUS server. If a username and password do not agree
with equivalent information on the RADIUS server, the CPS appliance is informed and the user is
denied CPS access. If the username and password are successfully validated on the RADIUS server,
the RADIUS server returns an attribute that indicates the access rights defined for that username.
To use RADIUS authentication, you must specify information about the primary RADIUS server
and optionally, a secondary RADIUS server to be used as a backup.
The RADIUS server definition values specified in CPS appliance commands must match
corresponding values configured on the RADIUS server. On the RADIUS server, you must include
CPS appliance-specific information: the list of valid users, their access rights for the CPS appliance
and their preemption levels. Each user-rights attribute in the RADIUS server’s dictionary must be
specified as a string containing the user’s access rights/level for the CPS appliance, exactly
matching the syntax used in the CPS User Add command. The access rights should be followed by
a space, the Preempt keyword and preemption value.
Consult your RADIUS administrator’s manual for information about specifying users and their
attributes. The exact process depends on the RADIUS server you are using.
No authentication
When authentication is disabled, users are not authenticated. Telnet sessions to serial ports are
accepted immediately, and users are not prompted for a username or password. In this case, users
are granted access only to the port to which they are connected, including Break access.
Connections to the Telnet port (23), serial CLI and PPP are still authenticated using the local CPS
user database, even when authentication is expressly disabled. Generally, these communications
paths are used only by administrators, and authentication is enforced in order to establish
appropriate access rights.
This method cannot be used when SSH connections are enabled, nor can it be combined with any
other authentication method.