RADIUS Authentication
A security feature that extends beyond the designation of ACLI User and Superuser privileges, the User Authentication and Access control feature supports authentication using your RADIUS server(s). In addition, you can set two levels of privilege, one for all privileges and more limited set that is read-only.
User authentication configuration also allows you to use local authentication, localizing security to the Oracle® Enterprise Session Border Controller ACLI log-in modes. These modes are User and Superuser, each requiring a separate password.
The components involved in the RADIUS-based user authentication architecture are the Oracle® Enterprise Session Border Controller and your RADIUS server(s). In these roles:
- The Oracle® Enterprise Session Border Controller restricts access and requires authentication via the RADIUS server; the Oracle® Enterprise Session Border Controller communicates with the RADIUS server using either port 1812 or 1645, but does not know if the RADIUS server listens on these ports
- Your RADIUS server provides
an alternative method for defining
Oracle® Enterprise Session Border Controller users and authenticating them via RADIUS; the RADIUS
server supports the VSA called ACME_USER_CLASS, which specifies what kind of
user is requesting authentication and what privileges should be granted.
The Oracle® Enterprise Session Border Controller also supports the use of the Cisco Systems Inc.™ Cisco-AVPair vendor specific attribute (VSA). This attribute allows for successful administrator login to servers that do not support the Oracle authorization VSA. While using RADIUS-based authentication, the Oracle® Enterprise Session Border Controller authorizes you to enter Superuser mode locally even when your RADIUS server does not return the ACME_USER_CLASS VSA or the Cisco-AVPair VSA. For this VSA, the Vendor-ID is 1 and the Vendor-Type is 9. The list below shows the values this attribute can return, and the result of each:
- shell:priv-lvl=15—User automatically logged in as an administrator
- shell:priv-lvl=1—User logged in at the user level, and not allowed to become an administrator
- Any other value—User rejected
When RADIUS user authentication is enabled, the Oracle® Enterprise Session Border Controller communicates with one or more configured RADIUS servers that validates the user and specifies privileges. On the Oracle® Enterprise Session Border Controller, you configure:
- What type of authentication you want to use on the Oracle® Enterprise Session Border Controller
- If you are using RADIUS authentication, you set the port from which you want the Oracle® Enterprise Session Border Controller to send messages
- If you are using RADIUS authentication, you also set the protocol type you want the Oracle® Enterprise Session Border Controller and RADIUS server to use for secure communication
Although most common set-ups use two RADIUS servers to support this feature, you are allowed to configure up to six. Among other settings for the server, there is a class parameter that specifies whether the Oracle® Enterprise Session Border Controller should consider a specific server as primary or secondary. As implied by these designation, the primary servers are used first for authentication, and the secondary servers are used as backups. If you configure more than one primary and one secondary server, the Oracle® Enterprise Session Border Controller will choose servers to which it sends traffic in a round-robin strategy. For example, if you specify three servers are primary, the Oracle® Enterprise Session Border Controller will round-robin to select a server until it finds an appropriate one; it will do the same for secondary servers.
The VSA attribute assists with enforcement of access levels by containing one of the three following classes:
- None—All access denied
- User—Monitoring privileges are granted; your user prompt will resemble ORACLE>
- Admin—All privileges are granted (monitoring, configuration, etc.); your user prompt will resemble ORACLE#
After it selects a RADIUS server, the Oracle® Enterprise Session Border Controller initiates communication and proceeds with the authentication process. The authentication process between the Oracle® Enterprise Session Border Controller and the RADIUS server takes place using one of three methods, all of which are defined by RFCs:
| Protocol | RFC |
|---|---|
| PAP (Password Authentication Protocol) | B. Lloyd and W. Simpson, PPP Authentication Protocols, RFC 1334, October 1992 |
| CHAP (Challenge Handshake Authentication Protocol) | B. Lloyd and W. Simpson, PPP Authentication
Protocols, RFC 1334, October 1992
W. Simpson, PPP Challenge Handshake Authentication Protocol (CHAP), RFC 1994, August 1996 |
| MS-CHAP-V2 | G. Zorn, Microsoft PPP CHAP Extensions, Version 2, RFC 2759, January 2000 |
Note:
MS-CHAP-V2 support includes authentication only; password exchange is not supported or allowed on the Oracle® Enterprise Session Border Controller.
PAP Handshake
For PAP, user credentials are sent to the RADIUS server include the user name and password attribute. The value of the User-Password attribute is calculated as specified in RFC 2865.
PAP Client Request Example
Radius Protocol
Code: Access Request (1)
Packet identifier: 0x4 (4)
Length: 61
Authenticator: 0x0000708D00002C5900002EB600003F37
Attribute value pairs
t:User Name(1) l:11, value:”TESTUSER1”
User-Name: TESTUSER1
t:User Password (2) l:18, value:739B3A0F25094E4B3CDA18AB69EB9E4
t:NAS IP Address(4) l:6, value:168.192.68.8
Nas IP Address: 168.192.68.8(168.192.68.8)
t:NAS Port(5) l:6, value:118751232CHAP Handshake
When the authentication mode is CHAP, the user credentials sent to the RADIUS server include “username,” “CHAP-Password,” and “CHAP-Challenge.” The “CHAP-Password” credential uses MD-5 one way. This is calculated over this series of the following values, in this order: challenge-id (which for the Oracle® Enterprise Session Border Controller is always 0), followed by the user password, and then the challenge (as specified in RFC 1994, section 4.1).
CHAP Client Request Example
Radius Protocol
Code: Access Request (1)
Packet identifier: 0x5 (5)
Length: 80
Authenticator: 0x0000396C000079860000312A00006558
Attribute value pairs
t:User Name(1) l:11, value:”TESTUSER1”
User-Name: TESTUSER1
t:CHAP Password (3) l:19, value:003D4B1645554E881231ED7A137DD54FBF
t:CHAP Challenge (60) l:18, value: 000396C000079860000312A00006558
t:NAS IP Address(4) l:6, value:168.192.68.8
Nas IP Address: 168.192.68.8(168.192.68.8)
t:NAS Port(5) l:6, value:118751232MS-CHAP-v2 Handshake
When the authentication method is MS-CHAP-v2, the user credentials sent to the RADIUS server in the Access-Request packet are:
- username
- MS-CHAP2-Response—Specified in RFC 2548, Microsoft vendor-specific RADIUS attributes
- MS-CHAP2-Challenge—Serves as a challenge to the RADIUS server
If the RADIUS authentication is successful, the Access-Accept packet from the RADIUS server must include an MS-CHAP2-Success attribute calculated using the MS-CHAP-Challenge attribute included in the Access-Request. The calculation of MS-CHAP2-Success must be carried out as specified in RFC 2759. The Oracle® Enterprise Session Border Controller verifies that the MS-CHAP2-Success attribute matches with the calculated value. If the values do not match, the authentication is treated as a failure.
MS-CHAP-v2 Client Request Example
Some values have been abbreviated.
Radius Protocol
Code: Access Request (1)
Packet identifier: 0x5 (5)
Length: 80
Authenticator: 0x0000024C000046B30000339F00000B78
Attribute value pairs
t:User Name(1) l:11, value:”TESTUSER1”
User-Name: TESTUSER1
t:Vendor Specific(26) l:24, vendor:Microsoft(311)
t:MS CHAP Challenge(11) l:18, value:0000024C000046B30000339F00000B78
t:Vendor Specific(26) l:58, vendor:Microsoft(311)
t:MS CHAP2 Response(25) l:52, value:00000000024C000046B30000339F00000B78...
t:NAS IP Address(4) l:6, value:168.192.68.8
Nas IP Address: 168.192.68.8(168.192.68.8)
t:NAS Port(5) l:6, value:118751232MS-CHAP-v2 RADIUS Response
Radius Protocol
Code: Access Accept (2)
Packet identifier: 0x6 (6)
Length: 179
Authenticator: 0xECB4E59515AD64A2D21FC6D5F14D0CC0
Attribute value pairs
t:Vendor Specific(26) l:51, vendor:Microsoft(311)
t:MS CHAP Success(11) l:45, value:003533s33d3845443532443135453846313...
t:Vendor Specific(26) l:42, vendor:Microsoft(311)
t:MS MPPE Recv Key(17) l:36, value:96C6325D22513CED178F770093F149CBBA...
t:Vendor Specific(26) l:42, vendor:Microsoft(311)
t:MS MPPE Send Key(16) l:36, value:9EC9316DBFA701FF0499D36A1032678143...
t:Vendor Specific(26) l:12, vendor:Microsoft(311)
t:MS MPPE Encryption Policy(7) l:6, value:00000001
t:Vendor Specific(26) l:12, vendor:Microsoft(311)
t:MS MPPE Encryption Type(8) l:6, value:00000006Management Protocol Behavior
When you use local authentication, management protocols behave the same way that they do when you are not using RADIUS servers. When you are using RADIUS servers for authentication, management protocols behave as described in this section.
- SSH in pass-through mode—The “user” or admin accounts are authenticated locally, not via the RADIUS server. For all other accounts, the configured RADIUS servers are used for authentication. If authentication is successful, the user is granted privileges depending on the ACME_USER_CLASS VSA attribute.
- SSH in non-pass-through mode—When you create an SSH account on the Oracle® Enterprise Session Border Controller, you are asked to supply a user name and password. Once local authentication succeeds, you are prompted for the ACLI user name and password. If your user ACLI name is user, then you are authenticated locally. Otherwise, you are authenticated using the RADIUS server. If RADIUS authentication is successful, the privileges you are granted depend on the ACME_USER_CLASS VSA attribute.
- SFTP in pass-through mode—If you do not configure an SSH account on the Oracle® Enterprise Session Border Controller, the RADIUS server is contacted for authentication for any user that does not have the user name user. The Oracle® Enterprise Session Border Controller uses local authentication if the user name is user.
- SFTP in non-pass-through mode—The “user” or admin accounts are authenticated locally, not via the RADIUS server. For all other accounts, the configured RADIUS servers are used for authentication.
RADIUS Authentication Configuration
To enable RADIUS authentication and user access on your Oracle® Enterprise Session Border Controller, you need to configure global parameters for the feature and then configure the RADIUS servers that you want to use.
RADIUS Server Settings
The parameters you set for individual RADIUS servers identify the RADIUS server, establish a password common to the Oracle® Enterprise Session Border Controller and the server, and establish trying times.
Setting the class and the authentication methods for the RADIUS servers can determine how and when they are used in the authentication process.
To configure a RADIUS server to use for authentication: