Feedback
Table Of Contents
Authenticating MARS Accounts with External AAA Servers
Information About Authenticating MARS User Accounts with External AAA Servers
Supported AAA Protocols and Servers
Summary of MARS Appliance AAA Configuration Tasks
Summary of AAA Server Configuration Tasks
Global Controller Considerations with External AAA Servers
Failed Authentication Lockout (Login Failure)
System Events related to Authentication and Login Attempts
System Reports and Rules Related to Authentication Method
Procedure for First-time Configuration of MARS AAA Feature
Unlock an Account after Login Failure
Authenticating MARS Accounts with External AAA Servers
Revised: April 5, 2007
External Authentication, Authorization, and Auditing (AAA) servers can act as the authentication mechanism for MARS Appliance GUI logins (username and password). This permits authentication and centralized password management for all MARS Appliances.
Table 14-1 Feature History for MARS Appliance AAA Authentication Method
4.3.1 and 5.3.1
This feature was introduced.
This chapter describes the Authentication, Authorization and Accounting (AAA) feature for the MARS Appliances and includes the following sections:
This chapter contains the following topics:
•
Information About Authenticating MARS User Accounts with External AAA Servers
•
•
•
Information About Authenticating MARS User Accounts with External AAA Servers
The administrator can configure MARS to authenticate GUI login attempts with an external AAA server, or with the default method of authenticating to the appliance's local database.
This section contains the following topics:
•
•
•
•
•
Supported AAA Protocols and Servers
The AAA protocol used by MARS is a basic Remote Authentication Dial In User Service (RADIUS) protocol. The supported external RADIUS servers are as follows:
•
•
•
Configuration Overview
The following overview describes the Local Controller. Global Controller differences are discussed in the section "Global Controller Considerations with External AAA Servers" section.
Summary of MARS Appliance AAA Configuration Tasks
1.
On each MARS Appliance to which a user must have access, the MARS administrator must create a user account for that user (contact information, group permissions and role). The account can be created on the Local Controller or on a Global Controller and pushed to the Local Controller.
2.
Each MARS Appliance must be individually configured to run the AAA authentication method. From the AAA Configuration page (Admin > System Setup > Authentication Configuration ), manually add external AAA servers in a procedure similar to that of adding a software security application on a new host.
Up to three AAA servers can be selected for AAA server authentication. They are named the primary, secondary, and tertiary servers, which signifies their rank in the AAA server failover sequence.
Note
When the MARS Appliance operates with the AAA authentication method, every login except the administrator accounts are authenticated by the external AAA server.
All authentication method changes, successful logins, and failed logins are captured as event messages.
Summary of AAA Server Configuration Tasks
1.
2.
See the user guide of your AAA server for details.
Global Controller Considerations with External AAA Servers
The following constraints and recommendations pertain to using the AAA authentication method with a Global Controller:
•
Using the Local authentication method, a user can have two accounts with the same login name and different passwords on a single appliance, for example, global:person1 created on the Global Controller and pushed to the Local Controller and local:person1 created on the Local Controller. Because the AAA server has only one password per login name, do the following to maintain the Local method functionality with the AAA method:
–
–
•
Configuring AAA Authentication Method on a Global Controller is similar to configuring AAA on a Local Controller, except that AAA servers cannot be added, edited or deleted on a Global Controller. The list of available AAA server names in the GUI is populated from the Local Controllers reporting to the Global Controller. The hostname of the reporting Local Controller is prepended to the AAA server name. The Global Controller should use an AAA server from the closest Local Controller on the network.
•
To avoid login problems, the optimal scenario is to have all Local Controller and Global Controllers use the same authentication method, either all Local or all AAA. For example, when a Global Controller uses AAA method, and a Local Controller uses Local method, any global user accounts pushed to the Local Controller will not have passwords. Any login attempt by the global user to that Local Controller fails until the administrator configures a password for the global account.
•
When a Global Controller and a Local Controller use different AAA servers for authentication the Global Controller login name and password must be configured in one of the Local Controller's AAA servers or the Global Controller user cannot log in to the Local Controller.
•
If a Local Controller deletes the AAA server in use by a Global Controller, the Global Controller is automatically switched to Local authentication. To reestablish AAA authentication for the Global Controller, the administrator must reconfigure the Global Controller to AAA authentication method and select another AAA server.
Just before a Local Controller being deleted from a Global Controller, a warning message appears if it is the Local Controller with the AAA server to which the Global Controller authenticates.
•
Unlocking is not replicated through Global Controller-Local Controller communications, it applies only to the local appliance. An account locked on a Global Controller does not replicate the locked status to global accounts on Local Controllers. A global account locked on two different appliances must be unlocked manually on each appliance.
Failed Authentication Lockout (Login Failure)
For both Local or AAA authentication methods, GUI access is prevented (locked) for an account upon login failure, which occurs when a specified number of incorrect password entries are made for a single login name.
The maximum number of password attempts before locking is set by the Maximum Login Failures parameter in the Account Lockout Policy box of the AAA configuration page (Admin > System Setup > Authentication Configuration ). The default setting is 5 attempts. By setting the Account Lockout Policy to Never Lock, the administrator can disable GUI locking for all accounts, but not specific accounts.
The count of incorrect attempts before login failure clears only when a successful login occurs, it does not age out. For example, if a user performs two incorrect password attempts then quits for the day, they must succeed on the first attempt the next morning or the account will be locked. A running session does not terminate if a login failure occurs for the same user account attempting to open another session, but the account will be locked to all future login attempts.
Once locked, an account must be unlocked by the MARS administrator. The Admin > User Management page of the GUI displays locked accounts. The Status column indicates if the account is active, locked or password expired. An administrator can unlock accounts from the User Management page by selecting the accounts and clicking Unlock.
Note
The CLI access through the console or through SSH is never locked. The unlock CLI command can unlock GUI access for some or all accounts. This is the recourse when the administrator is locked out from the GUI. For information on the unlock command, see the Cisco Security MARS Command Reference.
System Events related to Authentication and Login Attempts
Table 14-2 lists events triggered by Local and AAA authentication method actions.
System Reports and Rules Related to Authentication Method
For descriptions of MARS reports and rules, please see Appendix E, "System Rules and Reports."
System Reports
The following six reports disclose authentication events. All the reports are custom column, run on-demand only, with a time range of 1 day.
•
•
•
•
•
•
System Rules
The following three rules capture authentication method configuration actions:
•
•
•
The following system rule is triggered depending on how events are grouped:
•
Because MARS login successes and failures are grouped into event groups the following rules could fire if a MARS Local Controller is also the target of attacks described in each of the following rules:
•
•
•
•
•
Login events groups—Info/SuccessfulLogin/System/Root, Info/SuccessfulLogin/System/Non-root, Penetrate/GuessPassword/System/Root and Penetrate/GuessPassword/System/Non-root
Procedure for First-time Configuration of MARS AAA Feature
This procedure demonstrates a first-time configuration of AAA Authentication method for a MARS Appliance.
Summary of steps:
1.
2.
3.
Before You Begin
The following prerequisites are required to configure the AAA authentication method:
•
•
Tip
•
Note
•
–
–
–
–
–
To configure the MARS AAA Feature, follow these steps:
Step 1
Figure 14-1 Admin > System Setup Page
Step 2
If you are configuring a Global Controller, please skip to Step 10.
Figure 14-2 AAA Configuration Page
Add an external AAA Server
Step 3
The Add Reporting Device page appears, as shown in Figure 14-3.
Figure 14-3 Add Reporting Device Page
Step 4
The reporting application dialog appears as shown in Figure 14-4.
The usage guidelines for the configuration fields are equivalent to those for adding a monitoring device.
Note
Figure 14-4 Reporting Application Dialog
Step 5
The AAA Server Configuration pop-up window appears, as shown in Figure 14-5.
Figure 14-5 AAA Server Configuration Pop-up Window
Step 6
The default authentication and authorization port is 1812.
The default accounting port is 1813.
Step 7
A pop-up window appears for success or failure, as shown in Figure 14-6 and Figure 14-7.
Note
Figure 14-6 Connectivity Succeeds Pop-up Window
Figure 14-7 Connectivity Fails Pop-up Window
Step 8
You are returned to the AAA Configuration Page, as shown in Figure 14-2.
If the connectivity fails, you are returned to the AAA Server Configuration Pop-up Window, as shown in Figure 14-5. Troubleshoot the AAA server connection until connectivity succeeds.
Step 9
Select AAA Authentication
Step 10
If you are configuring a Global Controller, select the AAA server closest to the Global Controller.
Figure 14-8 Select Newly-added AAA Server From Drop-down List
Configure Account Lockout Policy (optional)
In the Account Lockout Policy box, configure the maximum login failures threshold, or click the Never Lock radio button.
Figure 14-9 Maximum Login Failure Parameter
Step 11
When the authentication method is changed from Local to AAA Server, all user passwords are removed from the MARS local database (except administrators). If you change the authentication method back to Local from AAA Server, you must reconfigure all the user passwords with the MARS GUI (Management > User Management).
When the MARS authentication is set to AAA server mode, user passwords can not be added or edited on the MARS User Management page.
End of Procedure for First-time Configuration of MARS AAA Feature.
Edit an External AAA Server
Step 1
Step 2
Step 3
Step 4
Figure 14-10 Edit Server Page
Step 5
Step 6
Step 7
You are returned to the AAA Configuration Page, as shown in Figure 14-2.
If the connectivity fails, you are returned to the AAA Server Configuration Pop-up Window, as shown in Figure 14-5. Troubleshoot the AAA server connection until connectivity succeeds.
Step 8
End of Edit an External AAA Server.
Delete an External AAA Server
Step 1
Step 2
Step 3
Step 4
Figure 14-11 Server Delete Confirmation
Step 5
If the AAA server deleted is a primary server used by a Global Controller, The Global Controller automatically switches to the Local authentication method and the administrator must reconfigure the Global Controller to AAA method and select another AAA server as required.
End of Delete an External AAA Server.
Unlock an Account after Login Failure
The following procedure details the steps required to unlock a non-administrative Local Controller or Global Controller account. To unlock an administrative account, use the unlock CLI command, as described in the Cisco Security MARS Command Reference.
A login failure to the MARS GUI is signaled by the Login Failure message, as shown in Figure 14-12.
Figure 14-12 Login Failure Message
Step 1
Step 2
The status column indicates which accounts are locked.
Click the check box of the user accounts to unlock.
Figure 14-13 Unlocking a Locked User Account
Step 3
End of Unlock an Account after Login Failure.
