topic Re: local authentication only if RADIUS is not reachable in Firewall and Security Management

local authentication only if RADIUS is not reachable

Patrick_Lajda — Mon, 04 Feb 2019 13:08:44 GMT

Hi,

is there any way to enable local authenticaion (i.e. admin user) only if the RADIUS servers is not reachable? That way only RADIUS users can authenticate on the firewall. If a network outage occurs (and RADIUS servers aren't reachable) the admin user could be used as fallback.

BR,
Patrick

Re: local authentication only if RADIUS is not reachable

PhoneBoy — Sat, 09 Feb 2019 00:19:27 GMT

See: How to disable local authentication when RADIUS authentication is available

Re: local authentication only if RADIUS is not reachable

MR_K — Wed, 06 Mar 2019 14:36:40 GMT

Hi,

That is exactly what I was looking for, thanks!

Just one thing:

The file states at the beginning:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.

And timestamps of the file shows that it was modified around the last power-up.

Is there a way to persist the setting?

BR Marcus

Re: local authentication only if RADIUS is not reachable

PhoneBoy — Thu, 07 Mar 2019 02:35:59 GMT

You'd have to set the immutable flag on the file (using chmod +i).

This will cause the file to not be overwritten.

To modify the file further, you will have to unset the immutable flag.

Re: local authentication only if RADIUS is not reachable

genisis__ — Thu, 27 Nov 2025 12:53:23 GMT

Hi Dameon,

We have a similar requirement, and want to clarify something (or I can raise a TAC case).

- We are using TACACS authentication, but sk105320 (does not exist anymore) only refers to RADIUS, additionally this SK has not been updated since R80.20 (We are running R81.x), how is this done for TACACS?

- Our requirement is to have the fall-back position at the application level ie. Smartconsole login and not via GAIA OS; does the procedure achieve this or is the SK related to GAIA OS only or both?

Update:

I logged a TAC case Sept 9th. To-date there has been zero progress on this!