Example user configuration

Example 1: Administrator user with local authentication

Goal: To create a user with administrator rights who is authenticated locally on the device.



  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click Authentication > Users.
  4. In Add User: enter a name for the user and click .

    The user configuration window is displayed.

  5. Enter a Password for the user.
  6. Assign the user to the admin group:
    1. Click Groups.
    2. For Add Group, click .
    3. For Group, select the admin group.
      1. Click Authentication > Groups.
      2. Click admin.
      3. Verify that the admin group has Admin access enabled. If not, click Admin access to enable.
      4. Verify that Access level is set to Full access. If not, select Full access.
      1. Click Authentication > Methods.
      2. Verify that Local users is one of the methods listed in the list. If not:
        1. For Add Method, click .
        2. For Method, select Local users.
  7. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the IX30 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. (config)> show auth group admin acl
admin
	enable true
	level full
...
(config)>

    If admin > enable is set to false:

    (config)> auth group admin acl admin enable true
(config)>

    If admin > level is set to read-only:

    (config)> auth group admin acl admin level full
(config)>

  4. (config)> show auth method
0 local
(config)>

    If local is not listed:

    (config)> add auth method end local
(config)>
  5. Create the user. In this example, the user is being created with the username adminuser:
    (config)> add auth user adminuser
(config auth user adminuser)>
  6. Assign a password to the user:
    (config auth user adminuser)> password pwd
(config auth user adminuser)>
  7. Assign the user to the admin group:
    (config auth user adminuser)> add group end admin
(config auth user adminuser)>
  8. Save the configuration and apply the change.
    (config auth user adminuser)> save
Configuration saved.
>
  9. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.

Example 2: RADIUS, TACACS+, and local authentication for one user

Goal: To create a user with administrator rights who is authenticated by using all three authentication methods.

In this example, when the user attempts to log in to the IX30 device, user authentication will occur in the following order:

  1. The user is authenticated by the RADIUS server. If the RADIUS server is unavailable,
  2. The user is authenticated by the TACACS+ server. If both the RADIUS and TACACS+ servers are unavailable,
  3. The user is authenticated by the IX30 device using local authentication.

This example uses a FreeRadius 3.0 server running on ubuntu, and a TACACS+ server running on ubuntu. Server configuration may vary depending on the platforms or type of servers used in your environment.



  1. Configure a user on the RADIUS server:
    1. On the ubuntu machine hosting the FreeRadius server, open the /etc/freeradius/3.0/users file: 
      $ sudo gedit /etc/freeradius/3.0/users
    2. Add a RADIUS user to the users file:
      admin1 Cleartext-Password := "password1"
	Unix-FTP-Group-Names := "admin"

      In this example:

      • The user's username is admin1.
      • The user's password is password1.
      • The authentication group on the IX30 device, admin, is identified in the Unix-FTP-Group-Names parameter.

    3. Save and close the users file.
  2. Configure a user on the TACACS+ server:
    1. On the ubuntu machine hosting the TACACS+ server, open the /etc/tacacs+/tac_plus.conf file: 
      $ sudo gedit /etc/tacacs+/tac_plus.conf
    2. Add a TACACS+ user to the tac_plus.conf file:
      user = admin1 {
	name ="Admin1 for TX64"
	pap = cleartext password1
	service = system {
		groupname = admin
		}
	}
}

      In this example:

      • The user's username is admin1.
      • The user's password is password1.
      • The authentication group on the IX30 device, admin, is identified in the groupname parameter.

    3. Save and close the tac_plus.conf file.
  3. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  4. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  5. Configure the authentication methods:
    1. Click Authentication > Methods.
    2. For Method, select RADIUS.
    3. For Add Method, click to add a new method.
    4. For the new method, select TACACS+.
    5. Click to add another new method.
    6. For the new method, select Local users.

  6. Create the local user:
    1. Click Authentication > Users.
    2. In Add User:, type admin1 and click .

    3. For password, type password1.
    4. Assign the user to the admin group:
      1. Click Groups.
      2. For Add Group, click .

      3. For Group, select the admin group.

      1. Click Authentication > Groups.
      2. Click admin.
      3. Verify that the admin group has Admin access enabled. If not, click Admin access to enable.
      4. Verify that Access level is set to Full access. If not, select Full access.
  7. Click Apply to save the configuration and apply the change.
  1. Configure a user on the RADIUS server:
    1. On the ubuntu machine hosting the FreeRadius server, open the /etc/freeradius/3.0/users file: 
      $ sudo gedit /etc/freeradius/3.0/users
    2. Add a RADIUS user to the users file:
      admin1 Cleartext-Password := "password1"
	Unix-FTP-Group-Names := "admin"

      In this example:

      • The user's username is admin1.
      • The user's password is password1.
      • The authentication group on the IX30 device, admin, is identified in the Unix-FTP-Group-Names parameter.

    3. Save and close the users file.
  2. Configure a user on the TACACS+ server:
    1. On the ubuntu machine hosting the TACACS+ server, open the /etc/tacacs+/tac_plus.conf file: 
      $ sudo gedit /etc/tacacs+/tac_plus.conf
    2. Add a TACACS+ user to the tac_plus.conf file:
      user = admin1 {
	name ="Admin1 for TX64"
	pap = cleartext password1
	service = system {
		groupname = admin
		}
	}
}

      In this example:

      • The user's username is admin1.
      • The user's password is password1.
      • The authentication group on the IX30 device, admin, is identified in the groupname parameter.

    3. Save and close the tac_plus.conf file.
  3. Select the device in Remote Manager and click Actions > Open Console, or log into the IX30 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  4. At the command line, type config to enter configuration mode:

    > config
(config)>

  5. Configure the authentication methods:
    1. Determine the current authentication method configuration:
      (config)> show auth method
0 local
(config)>

      This output indicates that on this example system, only local authentication is configured.

    2. Add RADIUS authentication to the beginning of the list:
      (config)> add auth method 0 radius
(config)>
    3. Add TACACS+ authentication second place in the list:
      (config)> add auth method 1 tacacs+(config)>
    4. Verify that authentication will occur in the correct order:
      (config)> show auth method
0 radius
1 tacacs+
2 local
(config)>
  6. (config)> show auth group admin acl
admin
	enable true
	level full
...
(config)>

    If admin > enable is set to false:

    (config)> auth group admin acl admin enable true
(config)>

    If admin > level is set to read-only:

    (config)> auth group admin acl admin level full
(config)>

  7. Configure the local user:
    1. Create a local user with the username admin1:
      (config)> add auth user admin1
(config auth user admin1)>
    2. Assign a password to the user:
      (config auth user adminuser)> password password1
(config auth user adminuser)>
    3. Assign the user to the admin group:
      (config auth user adminuser)> add group end admin
(config auth user adminuser)>
  8. Save the configuration and apply the change.
    (config auth user adminuser)> save
Configuration saved.
>
  9. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.