-
Cisco ACNS Software Configuration Guide for Centrally Managed Deployments, Release 5.2
-
Index
-
Title Page
-
Preface
-
Chapter 1: Understanding the ACNS 5.2 Network
-
Chapter 2: Using the Content Distribution Manager GUI
-
Chapter 3: Getting Started
-
Chapter 4: Setting Up Content Request Routing in the ACNS Network
-
Chapter 5: Configuring the ACNS Network for Content Distribution
-
Chapter 6: Configuring the ACNS Network for Content Acquisition
-
Chapter 7: Creating and Managing Programs
-
Chapter 8: Configuring Caching Services
-
Chapter 9: Configuring Streaming Media Services
-
Chapter 10: Working with Device Configurations
-
Chapter 11: Configuring Network Interfaces
-
Chapter 12: Configuring Request Processing Services
-
Chapter 13: Configuring Request Authentication and Authorization
-
Chapter 14: Configuring Login Authentication and Authorization
-
Chapter 15: Creating and Managing IP Access Control Lists
-
Chapter 16: Configuring Platform and System Settings
-
Chapter 17: Upgrading and Downgrading the Software
-
Chapter 18: Monitoring the ACNS Network
-
Chapter 19: Backup and Recovery Procedures
-
Appendix A: Creating Manifest Files
-
Appendix B: Configuring Disk Space
-
Appendix C: IP Multicast Addressing
-
Appendix D: Advanced Routing Configurations
-
Appendix E: Mapping ACNS Software CLI Commands to the Content Distribution Manager GUI
-
Table Of Contents
Configuring Login Authentication, Configuration Authorization and Accounting
Understanding Login Authentication and Authorization
Default Login Authentication and Authorization Configuration
Understanding Login Authentication Failover
Understanding Local Login Authentication and Authorization
Understanding RADIUS Authentication and Authorization
Understanding TACACS+ Authentication and Authorization
Configuring Login Authentication and Configuration Authorization
Configuring Login Authentication Servers
Configuring RADIUS Server Settings
Configuring TACACS+ Server Settings
Configuring Authentication and Authorization Schemes
Understanding User Accounts and Privilege Profiles
Configuring User Accounts and Assigning Privileges
Creating and Managing User Accounts
Creating New User Accounts Using the Content Distribution Manager GUI
Modifying and Deleting User Accounts
Assigning Roles to User Accounts
Modifying and Deleting Domains
Assigning Domains to User Accounts
Changing the CLI User Password
Configuring Login Authentication, Configuration Authorization and Accounting
This chapter explains how to configure login (user) authentication and configuration authorization support for Content Distribution Managers, Content Engines, and Content Routers deployed in a centrally managed environment. It describes how to configure devices to use local authentication, RADIUS, or TACACS+ login authentication methods.
This chapter contains the following sections:
•
Understanding Login Authentication and Authorization
•
•
•
Note
Understanding Login Authentication and Authorization
Login authentication and authorization is used to control user access rights to Content Distribution Managers, Content Engines, and Content Routers. Login authentication is the act of verifying usernames and passwords. Configuration authorization refers to the setting of privileges for authenticated users in a network. Generally, login authentication precedes configuration authorization in a network.
When you log in to a device before authentication and authorization have been configured, you can access the device by using the default user account and password. Devices that are running ACNS software come with a single, predefined superuser user account (root administrator) that can be used for initial access to the device in order to initially configure the device and then add other user accounts. The username for this predefined superuser user account is admin and the default password is default. (If these defaults have been changed by another ACNS system administrator, you need to obtain the new username and password.)
Users with administrative privileges can add, delete, or modify user accounts through the Content Distribution Manager GUI or the device CLI. For example, if an administrator logs in to a Content Engine with the predefined ACNS software superuser account (root administrator), the Content Engine grants that user the highest privilege level (level 15), which allows that user to perform any Content Engine administrative task during that login session.
For instance, that user could perform any of the following administrative tasks:
•
•
•
For more information about managing user accounts, see the "Understanding User Accounts and Privilege Profiles" section.
User authentication data and user configuration privilege data can be maintained in any combination of these three databases in a centrally-managed ACNS network:
•
•
•
Options are provided during Content Distribution Manager setup to choose between using an external access server or the internal (local) Content Distribution Manager-based authentication, authorization, and accounting (AAA) system for user access management. You can choose one method or any combination of the three methods.
If all three databases are enabled, then all databases are queried; if the user data cannot be found in the first database queried, then the second and third databases are queried. By default, Content Distribution Managers, Content Engines, and Content Routers use the local database to process login requests, with TACACS+ and RADIUS both disabled for login and configuration.
When the administrator logs in to a Content Distribution Manager, Content Engine, or Content Router, the device checks the specified authentication database to verify the user's username and password and to determine the access rights that this particular user should be granted during this login session.
Note
Default Login Authentication and Authorization Configuration
Table 14-1 lists the default configuration for login authentication and authorization.
You can change these defaults through the Content Distribution Manager GUI or through the device CLI, as described in the "Configuring Login Authentication and Configuration Authorization" section.
Understanding Login Authentication Failover
By default, ACNS devices fail over to the secondary method of login authentication whenever the primary login authentication method fails. In ACNS software, Release 5.0.5 and later, you can change this default login authentication failover method. For centrally managed deployments, you can use the Content Distribution Manager GUI (for example, choose Devices > Devices > General Settings > Authentication > Login Authentication and check the Enable Failover Server Unreachable box) or the CLI (use the authentication fail-over server unreachable global configuration command) to enable the failover due to unreachable server option.
Failover occurs only if the specified authentication server is unreachable. The following example sets login authentication failover to occur if the authentication server is unreachable. In this case, the Content Engine will only query the next authentication method if the login authentication server is unreachable.
ContentEngine(config)#authentication fail-over server-unreachableContentEngine(config)#To use the login authentication failover feature, you must set TACACS+, or RADIUS as the primary login authentication method, and local as the secondary login authentication method.
If the failover due to unreachable server option is enabled, then note the following:
•
•
For example, if the failover due to server unreachable option is enabled and RADUIS is set as the primary login authentication scheme and local is set as secondary login authentication scheme, the following occurs:
1.
2.
3.
Note
Conversely, if the failover due to unreachable server option is disabled, then the device contacts the secondary authentication database regardless of the reason why the authentication failed with the primary authentication database.
If all the authentication databases are enabled for use, then all the databases are queried in the order of priority selected and based on the failover reason. If no failover reason is specified, then all the databases are queried in the order of their priority. For example, first the primary authentication database is queried, then the secondary authentication database is queried, and finally the tertiary database is queried.
The local and the remote databases (TACACS+ and RADIUS) can be enabled or disabled through the Content Distribution Manager GUI or through the device CLI. The device verifies whether all are disabled and if so, sets the system to the default state (that is, local database is queried for authentication). (For information about this default state, see the "Default Login Authentication and Authorization Configuration" section.)
For more information on the various types of login authentication and authorization schemes, see the following sections:
•
•
•
For information about how to configure login authentication and authorization on Content Distribution Managers, Content Engines, and Content Routers, see the "Configuring Login Authentication and Configuration Authorization" section
Understanding Local Login Authentication and Authorization
ACNS 5.x software provides authentication, authorization, and accounting (AAA) support for users who need a local access database with AAA features. Local login authentication can be configured on individual Content Engines using the Content Engine GUI or CLI, or when devices are managed centrally, local login can be configured using the Content Distribution Manager GUI.
When the primary login server and primary configuration server are set to local, usernames and passwords are local to each device and are not mapped to individual usernames. Local authentication and authorization uses locally configured login and passwords to authenticate login attempts.
By default, local login authentication is enabled first. You can disable local login authentication only after enabling one or more of the other login authentication methods. However, when local login authentication is disabled, if you disable all other login authentication methods, local login authentication is reenabled automatically.
Understanding RADIUS Authentication and Authorization
RADIUS is a client/server authentication and authorization access protocol used by a network access server (NAS) to authenticate users attempting to connect to a network device. The NAS functions as a client, passing user information to one or more RADIUS servers. The NAS permits or denies network access to a user based on the response it receives from one or more RADIUS servers. RADIUS uses the User Datagram Protocol (UDP) for transport between the RADIUS client and server.
You can configure a RADIUS key on the client and server. If you configure a key on the client, it must be the same as the one configured on the RADIUS servers. The RADIUS clients and servers use the key to encrypt all RADIUS packets transmitted. If you do not configure a RADIUS key, packets are not encrypted. The key itself is never transmitted over the network.
Note
RADIUS authentication is disabled by default. You can enable RADIUS authentication and other authentication methods at the same time. You can also specify which method to use first. For more information about configuring RADIUS authentication, see the "Configuring Login Authentication and Configuration Authorization" section.
Understanding TACACS+ Authentication and Authorization
TACACS+ controls access to network devices by exchanging Network Access Server (NAS) information between a network device and a centralized database to determine the identity of a user or an entity. TACACS+ is an enhanced version of TACACS, a User Datagram Protocol (UDP)-based access-control protocol specified by RFC 1492. TACACS+ uses TCP to ensure reliable delivery and encrypt all traffic between the TACACS+ server and the TACACS+ daemon on a network device.
TACACS+ works with many authentication types, including fixed password, one-time password, and challenge-response authentication. TACACS+ login authentication occurs when a user first logs on to the locally deployed Content Engine.
When a user requests restricted services, TACACS+ encrypts the user password information using the MD5 encryption algorithm and adds a TACACS+ packet header. This header information identifies the packet type being sent (for example, an authentication packet), the packet sequence number, the encryption type used, and the total packet length. The TACACS+ protocol then forwards the packet to the TACACS+ server.
A TACACS+ server can provide authentication, authorization, and accounting functions. These services, while all part of TACACS+, are independent of one another, so a given TACACS+ configuration can use any or all of the three services.7-7
When the TACACS+ server receives a packet, it does the following:
•
•
You can configure a TACACS+ key on the client and server. If you configure a key on the Content Engine, it must be the same as the one configured on the TACACS+ servers. The TACACS+ clients and servers use the key to encrypt all TACACS+ packets transmitted. If you do not configure a TACACS+ key, packets are not encrypted.
TACACS+ authentication is disabled by default. You can enable TACACS+ authentication and local authentication at the same time. For more information about configuring TACACS+ as a login authentication scheme, see the next section.
Configuring Login Authentication and Configuration Authorization
To configure login authentication and authorization for a Content Distribution Manager, Content Engine or Content Router, complete the following tasks:
1.
2.
For example, specify the IP address of the remote RADIUS servers or TACACS+ servers that the device should use to authenticate log-in requests.
3.
–
–
–
Caution
When local authentication is disabled, if you disable all other authentication methods, local authentication is reenabled automatically.
Configuring Login Authentication Servers
If you have determined that your login authentication scheme is to include one or both external authentication servers, you must configure these server settings before you can configure the authentication scheme in the Content Distribution Manager GUI. The following sections provide steps for configuring RADIUS and TACACS+ server settings using the Content Distribution Manager GUI.
Configuring RADIUS Server Settings
RADIUS authentication clients reside on devices running ACNS 5.x software. When enabled, these clients send authentication requests to a central RADIUS server, which contains user authentication and network service access information.
Tip
To configure RADIUS server settings using the Content Distribution Manager GUI, follow these steps:
Step 1
Step 2
Step 3
Figure 14-1 RADIUS Server Settings Window
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Configuring TACACS+ Server Settings
The TACACS+ database validates users before they gain access to a Content Engine. TACACS+ is derived from the United States Department of Defense (RFC 1492) and is used by Cisco Systems as an additional control of nonprivileged and privileged mode access. ACNS 5.x software supports TACACS+ only and not TACACS or Extended TACACS.
Tip
To configure TACACS+ server settings using the Content Distribution Manager GUI, follow these steps:
Step 1
Step 2
Step 3
Figure 14-2 TACACS+ Server Settings Window
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Configuring Authentication and Authorization Schemes
To configure the login authentication and configuration authorization scheme for the device, follow these steps. In the following example, local is configured as the primary database, TACACS+ as the secondary database, and RADIUS as the tertiary database.
Step 1
Step 2
Step 3
Figure 14-3 Login Authentication Settings Window
Step 4
To use this feature, you must set TACACS+ or RADIUS as the primary authentication method and local as the secondary authentication method.
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Note
Understanding User Accounts and Privilege Profiles
ACNS software uses privilege profiles to determine which tasks a user can perform, and the level of access provided.
The two types of predefined privilege profiles are:
•
•
A privilege profile must be assigned to each new user account. A Content Distribution Manager, Content Engine, or Content Router that is running ACNS software comes with a predefined superuser account that can be used initially to access the device and add other users.
Configuring User Accounts and Assigning Privileges
In a service provider environment, it is necessary to manage user authorization to services and access to domains (sets of Content Engines, device groups, and content providers). Typically, a service provider creates a user account for itself with administrator-level privileges, and then creates user accounts for its customers. Service provider customers then have the ability to set up and manage user accounts on their own, which inherit the same level of rights as their main customer account, unless the customers choose to further limit user account privileges.
ACNS 5.x software provides services for user administration, role management, domain management, and accounting. These services can be configured in the Content Distribution Manager GUI.
Tasks include the following:
•
•
ACNS 5.2 software supports a user manager account for creating and managing user accounts. The user manager is responsible for creating a group of user accounts, assigning roles and domains, as well as modifying any other user accounts in the Content Distribution Manager. User managers must be assigned the admin role, which authorizes all services and access to all domains. Only users with administrator-level authorization are allowed to create and manage user accounts.
After an upgrade to ACNS 5.2 software, any user accounts that do not meet the above requirement are prevented from performing user manager services. In other words, these users can log in to the Content Distribution Manager GUI but do not have access to the User Management pages. These accounts can access the User Management pages by having their authorization increased to the administrator role. This can only be done by those users with the administrator role.
Creating and Managing User Accounts
When you create a user account, you enter information about the user. A user account contains a username, the name of the individual who owns the account, contact information, job title, and department. All user account information is stored in an internal database on the Content Distribution Manager.
Each user account can then be assigned to a role and a domain. A role defines which Content Distribution Manager GUI configuration pages the user can access and which services the user has authority to configure or modify. A domain defines which entities in the network the user can access and configure or modify. You can assign a user account to zero or more roles, and to zero or more domains.
Two default user accounts are preconfigured in the Content Distribution Manager and come with the ACNS software. The first account, called admin, is assigned the administrator role that allows access to all services and access to all entities in the system. This account cannot be deleted from the system, but it can be modified. Only the username and the role for this account are unchangeable.
The second preconfigured user account is called default. Any user account that is authenticated but has not been registered in the Content Distribution Manager obtains the access rights (role and domains) assigned to the default account. This account is configurable, but it cannot be deleted nor its username changed.
Using the Content Manager Distribution GUI, you can perform these tasks:
•
•
•
Creating New User Accounts Using the Content Distribution Manager GUI
When you create a new user account in the Content Distribution Manager GUI, you have the option to create the user account in the CLI at the same time. Using this GUI option to create the new account in the CLI provides the following benefits:
•
•
•
If you choose to create the user account from the GUI without creating the user account in the CLI at the same time from the GUI, the following results apply:
•
•
•
•
If a user account has been created from the CLI only, when you log in to the Content Distribution Manager for the first time, the Centralized Management Ssystem (CMS) automatically creates a user account (with the same username as configured in the CLI) with default authorization and access control. However, to change the password in this scenario, the user account must be explicitly configured from the GUI with CLI user option enabled.
To create a new user account, follow these steps:
Step 1
Figure 14-4 Creating New User Account Window
Step 2
Step 3
Step 4
Step 5
Note
Step 6
Step 7
Step 8
Modifying and Deleting User Accounts
Note
To modify an existing user account, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Note
To delete a user account from the Content Distribution Manager GUI, follow these steps:
Step 1
Step 2
Step 3
Note
Step 4
Viewing User Accounts
To view all user accounts, choose System > Users from the Content Distribution Manager GUI. The User Accounts window displays all the user accounts in the management database.
Creating and Managing Roles
The Content Distribution Manager provides many types of services. Not all users have access to all services. Users are assigned a role, which indicates what services they have access to. A role is a set of enabled services.
Each user account can be assigned to zero or more roles. Roles are not inherited or embedded. Using the Content Distribution Manager GUI, you can perform these tasks:
•
•
•
•
The Content Distribution Manager provides one predefined role, known as the admin role. The admin role has access to all services and all ACNS network entities. To create a role, follow these steps:
Step 1
Step 2
Figure 14-5 Creating New Role Window
Step 3
Step 4
Step 5
Step 6
Modifying and Deleting Roles
Note
To modify a role, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Viewing Role Settings
You might want to view role settings before assigning a role to a particular user account.
To view role settings, follow these steps:
Step 1
Step 2
Step 3
Step 4
The role names, comments about this role, and services that are enabled for this role are displayed.
Step 5
Assigning Roles to User Accounts
Note
To assign roles to user accounts, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Note
Step 6
Configuring Domains
A domain is a set of ACNS network entities or objects that make up the ACNS network. Whereas a role defines which services a user can perform in the ACNS network, a domain defines which entities the user has access to. The Content Distribution Manager GUI provides three predefined entities. An entity can be a Content Engine, content provider, or device group. These predefined entities are treated like services and can be enabled or disabled when you set up user roles.
When you configure a domain, you can choose to include Content Engines, content providers, or device groups in the domain. Using the Content Distribution Manager GUI, you can perform these tasks:
•
•
•
To create a new domain, follow these steps:
Step 1
Step 2
Figure 14-6 Creating New Domain Window
Step 3
Step 4
Step 5
Step 6
Adding an Entity to a Domain
To add an entity to a domain, follow these steps:
Step 1
Step 2
Figure 14-7 Entity Assignment to Domain Window—Content Provider Entity Shown
Step 3
Alternatively, you can click the Assign all icon in the taskbar to add all entities to the selected domain.
Step 4
Alternatively, you can click the Remove all icon in the taskbar to remove all entities from the domain.
Step 5
Modifying and Deleting Domains
To modify or delete an existing domain, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Viewing Domains
To view the domain configuration for a particular user account, follow these steps:
Step 1
Step 2
Step 3
Step 4
The domain name, entity type, comments about this domain, and entities assigned to this domain are displayed.
Step 5
Assigning Domains to User Accounts
To assign domains to user accounts, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Note
Step 6
Changing the CLI User Password
Note
When you are logged in to the Content Distribution Manager GUI, you can change your CLI user password if you meet the following requirements:
•
•
Note
Note
To change your CLI user password, follow these steps:
Step 1
Step 2
Step 3
Step 4
Configuring AAA Accounting
Collectively, authentication, authorization, and accounting are sometimes referred to as AAA. Central management of AAA means the information is in a single, centralized, secure database. This is much easier to administer than information distributed across numerous devices.
Authentication determines who the user is and whether he or she should be allowed access to the network. It allows network administrators to bar intruders from their networks. It may use a simple database of users and passwords. It can also use one-time passwords.
Authorization determines what the user is allowed to do. It allows network managers to limit which network services are available to different users.
Accounting tracks what users did and when they did it. It can be used for an audit trail or for billing for connection time or resources used (bytes transferred).
The TACACS+ protocol allows effective communication of AAA information between Content Engines and a central server. It uses TCP for reliable connections between clients and servers. Content Engines send authentication and authorization requests, as well as accounting information to the TACACS+ server.
The ACNS accounting feature uses TACACS+ server logging. Accounting information is sent only to the TACACS+ server and not to the console or any other device. The syslog file on the Content Engine logs accounting events locally. The format of events stored in the syslog is different from the format of accounting messages.
Note
To configure AAA accounting settings, follow these steps:
Step 1
Step 2
Step 3
Figure 14-8 AAA Accounting Settings Window
Step 4
Step 5
Step 6
Step 7
Caution
Step 8
Viewing Audit Trail Logs
The Content Distribution Manager logs user activity in the system. The only activities that are logged are those that change the ACNS network. This feature provides accountability in terms of which user did what and when. Logged activities include the following:
•
•
•
To view audit trail logs, follow these steps:
Step 1
Figure 14-9 Audit Log Window
Step 2
