PortAuthorityVersion 2.1.0 Build 548-006IntroductionThis release note documents commands and features not covered in the PortAuthority Administrator's Guide. See "Software Requirements", "Limitations of PortAuthority" and "Known Issues" for more information before installing.
Contents
Software RequirementsOperating System
PortAuthority is certified to run on the following platforms:
PortAuthority is certified to run using the following Java environments:
Bugs FixedBugs Fixed in Build 548-005
New Features/Changes to the ManualThe CallCheck plug-in will now follow the the Method-On-Fail chain when a packet is processed that is not of Service-Type=Call-Check. PortAuthority now supports crypt passwords stored in user records. The syntax for specifying a password as UNIX crypt style is: Password="{crypt}XXXXXXXXXX" Where XXXXXXXXXX is the crypt password. The DenyUser plug-in's behavior is controlled by the DenyUser-PassThruMode property. If set to TRUE, then the rejection type is "user error" when a user is found in the list, which follows Method-On-Fail. If FALSE, then the rejection type is "forbidden" when a user is found in the list, which terminates the method chain. The FilePass plug-in now has a FilePass-AllowMissingPassword method property. This will allow packets to be processed that do not contain a password. Valid settings for this method property are True and False. This property must be set to True when used to process Auth packets of Service-Type = Call-Check. FilePass now supports User-Names up to 253 octets in length The Proxy plug-in will now forward Access-Challenge from a remote host back to a client. PortAuthority may optionally log to a syslog server rather then a file. To configure this set the property "Log_Location" in server_properties to the following:Log_Location="method=syslog, host=<HOST>, facility=<FACILITY>, level=<LEVEL>" Where <HOST> is the name of the host to send the syslog messages to. Where <FACILITY> is one of the following keywords that represent a syslog facility:
Password="{SHA}XXXXXXXXXX" Where XXXXXXXXXX is the encrypted password. The USS now supports the following type of limits:
User is a per User-Name limit. DNIS is based on the called station ID. Realm is based on the users Realm. Group1, Group2, and Group3 are arbitrary user groupings. The Following are the valid method tags for controlling the limits:
StateLimits-UserLimit - This tag is used to assign the per user limit based
on User-Name.
StateLimits-UserLabel - This tag is used to uniquely identify a user when
counting the users limit (For example if you have
two users called bob in different name spaces) and
should be set to a unique string for each name
space for each unique user.
StateLimits-DNISLimit - This tag is used to assign an overall limit for a
single Called-Station-Id.
StateLimits-RealmLimit - This tag is used to assign an overall limit for a
single user realm.
StateLimits-Group1Limit - This tag is used to assign an overall limit for the
first arbitrary group.
StateLimits-Group2Limit - This tag is used to assign an overall limit for the
second arbitrary group.
StateLimits-Group3Limit - This tag is used to assign an overall limit for the
third arbitrary group.
StateLimits-Group1Name - This tag is used to set a unique name to identify
the first arbitrary group.
StateLimits-Group2Name - This tag is used to set a unique name to identify
the second arbitrary group.
StateLimits-Group3Name - This tag is used to set a unique name to identify
the third arbitrary group.
*** NOTE: The User Label and Group Names are case sensitive. The following are considered three different groups: Rei rei REI The syntax has changed to allow each limit to be set to the value of an attribute as well as a constant. If an attribute is referenced as the value, then a default constant can be specified as well.To reference the value of an attribute, the following syntax can be used: "$<namespace>.<attribute>:<constant>" An example of this would be: StateLimits-UserLimit="$response.Port-Limit:1" This would mean: Get the value to use for the user limit from the Port-Limit attribute in the user's return items (the response). The "namespace" defines which set of attributes are being referenced; legal values are: request - Attributes in the accounting or access request response - Attributes in the user's return items. check - Attributes from the user's check-items. client - Attributes for this client from client_properties. server - Attributes from server_properties (global server attributes)You can now specify the port for the state server to use in the property file for the USS (uss_properties by default). This setting can be over ridden on the command line with the '-port' option. The format for this property is: StateServer_Port = <PORT> Where <PORT> is the port number you wish for the state server to use. You can now specify the IP address for the state server to use in the property file for the USS (uss_properties by default). The format for this property is: StateServer_LocalAddress = <IP ADDRESS> Where <IP ADDRESS> is the IP address you wish for the state server to use. By default the State Server will bind to all addresses. You can now reset the StateServer database by issuing the command 'reset' to the State server CLI. This will remove all records from the state server database. The TestClient program will not accept a '-nousername' option to allow the creation of RADIUS packets that do not have a User-Name Attribute Value Pair.Setting PortAuthority to Run on System StartupRunning PortAuthority as a Windows NT ServiceYou can configure your system to run PortAuthority as a service. The PortAuthority server starts automatically when the system starts up. The following requirements must be met to install PortAuthority as a service under Windows NT:
* PortAuthority is correctly running as an application on the Windows NT
host.
Installing the Service Perform the following steps to install the service:
S93radius:
#
case "$1" in
'start')
if [ -f /export/home/pa/bin/pa ]; then
/export/home/pa/bin/pa start
# Also if using USS
/export/home/pa/bin/pa uss
fi
;;
'stop')
if [ -f /export/home/pa/bin/pa ]; then
/export/home/pa/bin/pa stop
# Also if using USS
/export/home/pa/bin/pa stopuss
fi
;;
*)
echo "Usage: radius { start }"
;;
esac
Limitations of PortAuthorityPortAuthority does not support the following Lucent RADIUS 1.16 features:Menus Expiration PortAuthority does not support the following Lucent RADIUS 2.0.1 features:
Expiration
Crypt-Password
Supported Characters in User-Name Currently the FilePass plug-in only supports the following characters for use in the User-Name:
0 to z
When using "helper" plug-ins (Plug-ins that do other then user verification such as Message) in the the auth chain care must be taken when used in a failure cain as if the helper plug-in succeeded then the request will receive an Access-Accept in response. For example if an instance of the StateLimits plug-in On-Fail goes to the Message plug-in to log a message and the the chain stops the user will we authorized since the last plug-in returned a success (Message was logged) unless other verification (check) items fail. To prevent this condition make the last plug-in in a failure chain an instance of RejectAll. Currently both the USS plug-in and Proxy plug-in should be the last in the authentication chain. This cause them to not be compatible for use with each other. Proxy does not currently support a Method-Next option and if the USS is before proxy the USS will record the user as authenticated even if the Proxy instance rejects the user. Currently to clear a connection from the USS a new authentication request or a stop record must be inserted for the same port. This can be done by a new record from the NAS or manually through the CLI Currently the USS does not process NAS boot records or accounting start and stop requests to adjust state informationKnown IssuesCurrently the accounting directory is created relative to the directory that the pa startup script is run from. The CallCheck plug-in will not currently follow Method-On-Fail if the Called-Station-Id attribute is not present and the value of Calling-Station-Id or the value "No-Call-Id" will remain in the User-Name attribute value pair. When specifing the directory for accounting files it must be specified as an absolute path or a path relative to the current directory when the server is started. If an client is listed in the clients file using one format (FQN or host name) but the resolver returns the client name in a different format you may receive an unknown host error message even if the host is listed. For example if an FQN is used in the clients file and due to a host file entry a host name only entry is returned when resolving the client. DenyUser will log "User Not Found" when the user is found in the deny list. When DenyUser-PassThruMode is set to true and the server run in debug mode the plug-in will incorrectly report it will return Forbidden. The plug-in will perform as documented. If a Attribute Value Pair in a FilePass instance has a payload that exceeds the RFC allowed length an invalid response packet may be generated. The FilePass-ShadowFile currently requires an absolute path and does not make the file relative to the -files option on startup If you create a DEFAULT entry that does not have Auth-Type=System or Password="UNIX" it is not reported on init but is caught if a reload is issued in the telnet interface. *NOTE* Any users that match this entry will be authenticated regardless of Password. Entering an invalid value for an Attribute Value Pair of type IP Address may cause an invalid response packet to be generated. User entries over 1096 bytes may cause the server to hang on startup or when a reload command is issued for the user file. Currently the jre for running PortAuthority must be in the path and can not be called by an absolute reference. In some cases if a file a plug-in needs does not exist only the file name is logged and not the plug-in or instance name of the plug-in that is reporting the error. The last line in the method_select file must have a new line character on the end to function properly. The * realm will match a null entry as well as any undefined realm. There for the null realm must come before the * realm. Currently only one DEFAULT entry is allowed per instance of the FilePass plug-in. However you may have additional DEFAULT.{Suffix} entries and you mail chain multiple instances for FilePass together with each instance having a DEFAULT entry. Proxy is currently rejecting Access-Challenge packets. PortAuthority will not return the Proxy-State attribute if it is the final remote server in an proxy auth chain. This will cause problems on any server in the chain that requires Proxy-State. Any references to master.cfg should be referred to server_properties. If the uninstall option is used and the QuickStart option was selected on installation then not all files may be uninstalled and require manual removal. The USS will not currently list a session as active if only an accounting record is received with no authentication request first. If items that are used as counters (DNIS, Group Names, Labels) that are normally fixed in size/values are set to items that normally contain non-repeting data (i.e.: Group Name set to Calling-Station-Id) the JVM may abort the StateServer. If a user record contains verification items the user may be logged in the USS as authenticated but may be actually rejected. This is due to the fact that verification items other then Password are checked after all method instances are invoked in the authenticated chain. If a required attribute is missing from an Accounting packet a null pointer error is generated. This will only happen if the RADIUS client does not conform to the RFC standards. The USS will not correctly update the status of a session of the Start and Stop accounting records are received out of order or interleaved with another session. Entering the reset command in the USS comand line interface will cause all StateLimits instances to get a socket I/O error on the next packet processed by the instances. The StateLimts plug-ins will reconnect on the next packet proccessed.Installation InstructionsAn evaluation copy can be downloaded from:http://www.livingston.com/marketing/products/port-authority.html To install the software run setup.bat or setup.sh depending on your platform. You must have your JRE/JDK working before installing PortAuthorityCopyright and Trademarks(c) 1999 Lucent Technologies. All rights reserved. PortMaster, ComOS, and ChoiceNet are registered trademarks of Lucent Technologies Inc. RADIUS ABM, PMVision, IRX, and PortAuthority are trademarks of Lucent Technologies Inc. PolicyFlow is a service mark of Lucent Technologies Inc. All other marks are the property of their respective owners.
Internet service providers (ISPs) and other end users in Europe, the Middle East, Africa, India, and Pakistan should contact their authorized Lucent Remote Access sales channel partner for technical support; see http://www.livingston.com/International/EMEA/distributors.html. For North and South America and Asia Pacific customers, technical support is available Monday through Friday from 7 a.m. to 5 p.m. U.S. Pacific Time (GMT -8). Dial 1-800-458-9966 within the United States (including Alaska and Hawaii), Canada, and the Caribbean, or 1-925-737-2100 from elsewhere, for voice support. Otherwise, fax to 1-925-737-2110, or send email to rabm-support@ra.lucent.com (asia-support@ra.lucent.com for Asia Pacific customers). |