KNOWLEDGE BASE ARTICLE

2/2/2021
Configuring RADIUS with PADM20

PADM20 supports RADIUS authentication, authorization and accounting. For PADM20 and one or more
RADIUS servers to communicate with each other, they must each be configured. This document provides
information on configuring a RADIUS server for use with PADM20.

Prerequisites:
 One or more RADIUS entries exist in PADM20 [Security > User Accounts > Remote Servers*].
 PADM20 is set to use remote Authentication and/or Accounting [Security > Security Settings > AAA*]
 A version of RADIUS is installed and accessible by PADM20 over the network

* Refer to the PADM20 User Guide for details on creating RADIUS entries and setting AAA

This document uses FreeRadius ([Link]) as a RADIUS server reference. Configurations will
vary depending on the RADIUS server in use.

Configuring the Dictionary

The Dictionary identifies and defines of the attributes that can be exchanged between a RADIUS server
and PADM20 (the RADIUS client). Exhibit A of this document shows a sample '[Link]'
configuration for use with a FreeRadius server.

In configuring the RADIUS server, a Vendor ID needs to be specified. For Tripp Lite, the assigned ID is 850.
This ID allows the RADIUS server to understand and accept Tripp Lite-specific attributes sent by PADM20.
Likewise, it allows the server to respond with Tripp Lite-specific information.

Supported Attributes
Previous PowerAlert firmware releases, 15.x.x, supported three attributes:
 Tripp-Lite-Authorization
 Tripp-Lite-Outlet-Realms
 Tripp-Lite-Message

PADM20 introduces a new attribute for use in RADIUS: TrippLite-User-Role. This attribute grants access
based on PADM20 Roles. For example, a TrippLite-User-Role with a value of “Administrator” would grant
PADM20 Administrator privileges to the user. If a role “CustomRole1” is created in PADM20, a TrippLite-
User-Role with a value of “CustomRole1” would give the user all privileges associated with that role.

Note: PADM20 minimally supports the TrippLite-Authorization attribute to retain RADIUS access after an
upgrade from 15.x.x, in case the TrippLite-User-Role attribiute has not yet been configured. The table
below indicates the role PADM v20 will assign based on TrippLite-Authorization values.

Role Administrator Manager Guest

default=rw,security=rw default=rw,security=none default=ro
TrippLite-Authorization default=rwv default=rw,security=ro default=ro,security=ro
all other combinations
 KNOWLEDGE BASE ARTICLE

Configuring the Users

Each user requires a unique configuration. For a FreeRadius server, the user entries go into a single file
called “users.” A sample of the configuration file is given in Exhibit B

RADIUS Entry Example: User with PADM20 Administrator Privileges

The following is an example of an entry in the RADIUS user table:

radiusadmin Cleartext-Password := "radiusadmin1"

Reply-Message = "Hello, %{User-Name}",
TrippLite-User-Role = “Administrator”,
Session-Timeout = 2400,
Idle-Timeout = 1200

In this entry, the user name is 'radiusadmin' with a password of 'radiusadmin1'. Note that PowerAlert will
only generate authentication requests with a clear text password; no other exchange mechanism is
supported at this time.

The Reply-Message line defines the textual return response when the user authenticates successfully. It
is a standard component of a response to an authentication request, though not required by PADM20.

The TrippLite-User-Role string is required in all successful authentication responses. Failure to return said
string will default the user to no authorization. In this example, the user would receive privileges
associated with the default PADM20 Administrator role.

The Session-Timeout and Idle-Timeout strings are not defined in the dictionary. They are part of the
standard RADIUS configuration defined by RFC 2865 (i.e. not vendor-specific).

 Session-Timeout = the maximum number of seconds a session can be active before it is terminated.
In the case of PADM20, if this value is not sent, a user’s session will never timeout.

 Idle-Timeout = the maximum number of consecutive seconds a session can be idle before it is
terminated. In the case of PADM20, if this value is not sent, a user’s session will never expire due to
inactivity.

Configuring Client Access

Once the Dictionary and User Configurations are defined, the RADIUS server must be configured to
communicate with PADM20; this varies by RADIUS server, so refer to its documentation. For a FreeRadius
server, entries would be added to the [Link] file per the instructions provided with the sample
entries.
 KNOWLEDGE BASE ARTICLE

Exhibit A - Sample '[Link]' FreeRadius Configuration File

Below is a sample '[Link]' FreeRadius Configuration File. A similar dictionary can be viewed
on the FreeRadius GitHub:
[Link]
server/blob/master/share/dictionary/radius/[Link]

######################################################################

VENDOR TrippLite 850

BEGIN-VENDOR TrippLite

#
## Access is granted to the various facilities within the PowerAlert software
## by means of the TrippLite-Authorization attribute, which is a comma-delimited
## string of facility-code to access-level pairs.
##
## Facility Codes: default, security, networksettings, systemsettings, systreminfo,
## logging, devicestatus, devicecontrols, deviceevents,
## deviceloads, actions, schedules, discovery
##
## Access Levels: none (or 0), ro (or 1), rw (or 2)
##
## Example: default=rw,security=none,systemsettings=ro
##
## - The default access for all non-specified facilitys is read/write
## - The user has no access to the security facility
##

ATTRIBUTE TrippLite-Authorization 1 string

#
## Comma-delimited string of outlet security realms from 1 through 32 to which
## an otherwise restricted user has read-write access.
##
## Example: 1-5,10,15
##
## - User has read-write access to realms 1, 2, 3, 4 and 5
## - User has read-write access to realms 10 and 15
##

ATTRIBUTE TrippLite-Outlet-Realms 2 string

#
## Simple message, usually sent as part of accounting
##

ATTRIBUTE TrippLite-Message 3 string

#
## PADM20 user role. Role with same name should exists on the device.
##
ATTRIBUTE TrippLite-User-Role 4 string

END-VENDOR TrippLite
 KNOWLEDGE BASE ARTICLE

Exhibit B - Sample 'users' FreeRadius Configuration File Snippet

The following snippet defines simple sample of an account for PADM20:

# -------------------------------------------------------------------#
# PowerAlert Entries
# -------------------------------------------------------------------#
radiusadmin Cleartext-Password := "radiusadmin"
Reply-Message = "Hello, %{User-Name}",
TrippLite-User-Role = “Administrator”,
Session-Timeout = 2400,
Idle-Timeout = 1200