RADIUS authentication and role-based authorization for Symantec Management Center CLI

Products

• Management Center - VA

Issue/Introduction

RADIUS authentication functions correctly for the Management Center Web Graphical User Interface (GUI), but fails for Secure Shell (SSH) or Command Line Interface (CLI) sessions. This behavior occurs when the RADIUS server authenticates the user but does not provide the required authorization attributes to grant CLI access.

SSH/CLI login attempts return "Access Denied" or "Authentication Failed" when users log into the Web GUI successfully via RADIUS.

Environment

Symantec Management Center 3.x

External RADIUS Server (FreeRADIUS, Cisco ISE, Microsoft NPS, etc.)

Cause

CLI logins require authorization by the Vendor-Specific Attributes (VSAs). If the RADIUS server does not return the Blue-Coat-Group attribute, or if the user’s group is not assigned a role with "CLI Access" permissions in Management Center, the session is terminated.

Resolution

Configure RADIUS Server & Group Synchronization Settings

1. Log into the Management Center Web GUI using a local administrator account (admin).
2. Navigate to Administration > Settings > RADIUS using the gear icon menu on the left panel.
3. Configure the primary server parameters under the Primary RADIUS Server:
   • Check box: Is the authenticator enabled
   • RADIUS IP Address: (Enter the IP Address of RADIUS server)
   • Authentication Port: 1812
   • Accounting Port: 1813
   • Shared Secret: (Enter case-sensitive shared key)
   • Click Test Connection box

                 

• • Scroll down to General 
  • Check box: Sync the group membership
  • Group Membership Attribute: Blue-Coat-Group
  • Click Save and Activate (restart is required)

                 

Configure the Access Role:

1. Navigate to Administration > Roles using the gear icon menu on the left panel.
2. Click Add Role
3. Basic Info: Name: (Enter role's name; e.g. cliRole) > Next
4. Permissions: Click Add Permission 
5. Object: Management Center 
6. Action: CLI > Next > Finish

         

Map the RADIUS Group

1. Navigate to Administration > Groups using the gear icon menu on the left panel.
2. Click Add Group to create a new group
3. Name: (Enter group name; e.g. MCCliAdmins) > Next
4. Members: > Next
5. Assign Roles: Select Available Roles: cliRole to Assigned Role > Finish

     

Additional Information

1. RADIUS server's dictionary file must contain the following entries:

             VENDOR BlueCoat 14501

             BEGIN-VENDOR BlueCoat

             ATTRIBUTE Blue-Coat-Group 1 string

             END-VENDOR BlueCoat

2. RADIUS server's client configuration file must contain the following items:

             MC's IP address

             Shared Secret (case-sensitive shared key)             

3.RADIUS server's user file must contain the user's password and the group information: 

             e.g. testuser1 Cleartext-Password := "XXXXXX" Blue-Coat-Group = "MCCliAdmins" (based on an example above)

Ref: Configure Cisco ACS for Management Center