Radius settings not applied when using config.ini on NMC1 and NMC2

Anonymous user · ‎2021-06-29

After uploading a config.ini with the radius settings below, everything works until the NMC is rebooted and then you can't log in and must use a paper clip and console cable to allow login with apc/apc.

I found that after logging in with console cable and checking Radius settings it is prompting me to (8)Accept Changes. After I hit (8) it will say "Successful" and we can then log in with Radius.

If I reset the NMC to defaults and then upload the config.ini again and before rebooting it, use the GUI to "Administration" > "Security" > "RADIUS" > Click the Radius Server and then click "Skip Test and Apply" then I can reboot the NMC and Radius will work.

Is there a way to "Skip Test and Apply" through the config.ini?

[SystemRADIUS]
Access=RADIUS, then Local
PrimaryServer=10.2.160.10
PrimaryServerSecret=xxxxxxxxx
PrimaryServerTimeout=5
SecondaryServer=10.2.160.11
SecondaryServerSecret=xxxxxxxxxxx
SecondaryServerTimeout=5
DNSUpdateInterval=10

BillP · ‎2021-06-29

Hi Mike,

I just tried this on a Rack ATS which has the same OS as your PDU. I did not see an issue. What I did was:

Push a config.ini with a RADIUS server IP (which is not valid so the NMC should fall back to local auth) and a shared secret
Log in using local credentials. Network Management Card (NMC) interface takes noticeably longer to log in, presumably because RADIUS server contact is being tried.
Since RADIUS server IP is not reachable, NMC falls back to using local authentication.
Reboot and repeat process. Able to log in.

But I am interested to see if you can confirm any of my other questions to make sure I am truly simulating the same thing.

I also re-tried with my online RADIUS server but the problem I have is it is FreeRADIUS and my database is messed up so I can't authenticate users properly. I can get it to hit the RADIUS server though and tell me invalid username and password. Same through serial until I unplug the network cable so it falls back to local authentication with the network being disconnected and I can log in through local authentication.

I logged in via serial after a reboot and the RADIUS server settings are still there and it does not show as pending changes on the RADIUS config screen.

Does anything sound majorly different to you compared to what you did? From all my testing, it seems as though the test is being skipped.

If you don't notice anything crazy, I will also test with my Rack PDU to be safe, though I don't think it will be different. It is just more difficult for my to serial into based on where I have it installed

See Answer In Context

BillP · ‎2021-06-29

Hi Mike,

What firmware(s) did you try this on? I just tried what I think you did on NMC2 AOS 6.4.0 and didn't have a problem. My only possible difference is my NMC fell back to local authentication before and after reboot (successfully) because I don't have a working RADIUS server set up right this second. But, based on what you said, I assume that didn't work for you either if you had to get the paper clip out. I am also assuming you at some point tried credentials that are in the local database before going the serial access route as a last resort.

And when you are getting the serial cable out using apc/apc - are those the local database credentials you've left at default or what you're using as part of the password reset procedure?

What you've described as far as menus and behavior sounds just like NMC1 only but this does happen for you on NMC2 as well as mentioned in the title of the question? (or, it could be NMC2 older firmware too)

Once I know the NMC1 firmware, I can check further potentially on one of those devices as well as the intended behavior of our systems in general.

Anonymous user · ‎2021-06-29

Hello! This is on an AP7801 running what I thought was the latest firmware.

Name:	rpdu
Version:	v3.7.4
Date:	03/13/2012
Time:	16:16:54

Name:	aos
Version:	v3.9.0
Date:	05/11/2015
Time:	14:45:05

BillP · ‎2021-06-29

Hi - yes, that's the latest and that device is an NMC1. I'll give it a try with one of these tomorrow.

You had also tested this on an NMC2?

BillP · ‎2021-06-29

Hi Mike,

I just tried this on a Rack ATS which has the same OS as your PDU. I did not see an issue. What I did was:

Push a config.ini with a RADIUS server IP (which is not valid so the NMC should fall back to local auth) and a shared secret
Log in using local credentials. Network Management Card (NMC) interface takes noticeably longer to log in, presumably because RADIUS server contact is being tried.
Since RADIUS server IP is not reachable, NMC falls back to using local authentication.
Reboot and repeat process. Able to log in.

But I am interested to see if you can confirm any of my other questions to make sure I am truly simulating the same thing.

I also re-tried with my online RADIUS server but the problem I have is it is FreeRADIUS and my database is messed up so I can't authenticate users properly. I can get it to hit the RADIUS server though and tell me invalid username and password. Same through serial until I unplug the network cable so it falls back to local authentication with the network being disconnected and I can log in through local authentication.

I logged in via serial after a reboot and the RADIUS server settings are still there and it does not show as pending changes on the RADIUS config screen.

Does anything sound majorly different to you compared to what you did? From all my testing, it seems as though the test is being skipped.

If you don't notice anything crazy, I will also test with my Rack PDU to be safe, though I don't think it will be different. It is just more difficult for my to serial into based on where I have it installed