Technical data

Security Configuration 7-7
Configuring Authentication
You can use any of the following optional commands to interact with the RADIUS server host:
• radius-server retransmit number
This command specifies the number of times that the router transmits each RADIUS request to
the server before the router gives up.
• radius-server timeout seconds
This command specifies the number of seconds that an access server waits for a reply to a
RADIUS request before the access server retransmits the request. The default is five seconds. If
the RADIUS server’s response is slow (because of support for a large number of users or large
network latency), increase the timeout value.
For more information about these commands, refer to the Security Command Reference, which is
part of the Cisco IOS configuration guides and command references documentation.
Configuring Authentication on a TACACS+ Server
On most TACACS+ security servers, there are three ways to authenticate a user for login:
• Include a cleartext (DES) password for a user or for a group the user is a member of (each user
can belong to only one group). Note that ARAP, CHAP, and global user authentication must be
specified in cleartext.
The following is the configuration for global authentication:
user = mswartz {
global = cleartext "mswartz global password"
}
To assign different passwords for ARAP, CHAP, and a normal login, you must enter a string for
each user that specifies the security protocols, whether the password is cleartext, and if it
authentication is performed via a DES card. The following example shows a user carol, who has
authentication configured for ARAP, CHAP, and login. Her ARAP and CHAP passwords, “arap
password” and “chap password”, are shown in cleartext. Her login password has been encrypted.
user = carol {
arap = cleartext "arap password"
chap = cleartext "chap password"
login = des XQj4892fjk
}
• Use password (5) files instead of entering the password into the configuration file directly.
The default authentication is to deny authentication. You can change this at the top level of the
configuration file to have the default use passwd(5) file, by issuing the following command:
default authentication = /etc/passwd
• Authenticate using an s/key. If you have built and linked in an s/key library and compiled
TACACS+ to use the s/key, you can specify that a user be authenticated via the s/key, as shown
in the following example:
user= fred {
login = skey
}