User's Manual

Fortress ES-Series CLI Guide: Mesh Point CLI and Administrative Access
17
To use a remote Fortress RADIUS Server
to authenticate administrators:
To use a RADIUS server running on another Mesh Point on the
network to authenticate administrators for the current Mesh
Point, you must configure an entry for the remote server on the
current Mesh Point (with the
add auth command).
Only administrators with accounts flagged with an
-adminauth
option on the remote Mesh Point’s internal RADIUS server will
be able to authenticate through this service.
To use a third-party RADIUS Server
to authenticate administrators:
To use a third-party RADIUS server for administrator
authentication, it must be configured to use Fortress’s Vendor-
Specific Attributes for Fortress-Administrative-Role and
Fortress-Password-Expired, provided in the
dictionary.fortress configuration file included on the Mesh
Point software CD and available for download at
www.gdc4s.com
. Consult your RADIUS server documentation
for information on configuring the service.
An entry for the remote server must also be configured on the
current Mesh Point (with
add auth).
Configure all global administrative logon, password and
authentication settings for the Mesh Point with the
set account
command, as follows:
# set account
History Depth[0] (0-10, default is 0, maximum number of account changes to track):
Minimum Capital Letters[0] (0-5, minimum number of capitals in a password):
Minimum Lower Case Letters[0] (0-5, minimum number of lower case letters in a password):
Minimum Numbers[0] (0-5, minimum number of digits in a password):
Minimum Punctuation Marks[0] (0-5, minimum number of punctuation marks in a password):
Minimum Differences[0] (0-5, minimum number of character differences in a new password):
Minimum Length[15] (8-32, minimum length of a new password):
Expires[N] (Y|N, passwords expire after specified duration):
Expiration[60] (1-365, number of days before passwords expire):
Expiration warning[10] (0-365, number of days before warning that a new password is needed):
Force reset to conforming password[Y] (Y|N, force non conforming passwords to expire):
Display previous login[disable] (enable|disable, display information on the last session for this user):
UI Session Idle Timeout[0] ([0|60] default is 10, UI Session Idle Timeout in minutes):
UI Failed Attempt Time Holddown[5] ([0|60] default is 5, time to wait in seconds before a login will be allowed):
Use Dictionary[disable] (enable|disable, use the password dictionary):
Allow Consecutive Characters[enable] (enable|disable, allow consecutive characters in a new password):
MaxAttempts[3] (1-9, maximum number of failed attempts):
LockoutPermanent[N] (Y|N, lock this account permanently):
LockoutDuration[0] (0-60, lockout time in minutes if not locked permanently):
AccountAuthMethod[local] (local|radius, authentication method to use):
AccountAuthFailback[enable] (enable|disable, enables or disables authentication failback):