FTP Proxy Service With RADIUS User Authentication

The following information is used in this example:

To Configure the FTP Proxy Service With RADIUS User Authentication

1. Follow the steps in the section above, "Configuring RADIUS Authentication".

2. Configure the FTP Proxy Service:

   1. Create a Proxy user group, for example, ftp-grp.

   2. Add predefined users radius and securid to ftp-grp.

      # ssadm edit Policy > proxyuser add ftp-grp GROUP > proxyuser addmember ftp-grp radius > proxyuser addmember ftp-grp securid

   3. For each user that will be using the FTP Proxy:

      1. Create a record in the Authorized User database.

      2. Create a record in the Proxy User database.

      3. Add the user as member of ftp-grp:

         # ssadm edit Policy > authuser add au1 PASSWORD=\{ au1_pw \} > proxyuser add pu1 auth_user_name=au1 backend_user_name=bu1 > proxyuser addmember ftp-grp pu1

         This example assumes C shell. The backslash \ before the brackets is the escape key from special characters { and }. For Bourne shell, the backslash is not necessary.

         Since there are typically many users to administer, this is a good task to automate with a script.

   4. Add a rule to allow the FTP proxy for the proxy user group, ftp-grp.

      # ssadm edit Policy edit> Add Rule ftp USER ftp-grp ALLOW PROXY_FTP FTP_GET FTP_CHDIR edit> save # ssadm activate Policy

3. Test the FTP Proxy with RADIUS authentication:

   FTP proxy login	ftp sunscreen_fw
   Username@Hostname	bu1@ftp_server
   Password	bu1_radpw@bu1_pw

   # ftp sunscreen_fw Username@Hostname: radius_user@ftp_server Password: radius_user_pw@password_at_ftp_server