local authentication only if RADIUS is not reachable

[Patrick_Lajda]

Hi,

is there any way to enable local authenticaion (i.e. admin user) only if the RADIUS servers is not reachable? That way only RADIUS users can authenticate on the firewall. If a network outage occurs (and RADIUS servers aren't reachable) the admin user could be used as fallback.

BR,
Patrick

[PhoneBoy · Accepted solution]

See: How to disable local authentication when RADIUS authentication is available 

[MR_K]

Hi,

That is exactly what I was looking for, thanks!

Just one thing:

The file states at the beginning:

#%PAM-1.0
# This file is auto-generated.
# User changes will be destroyed the next time authconfig is run.

And timestamps of the file shows that it was modified around the last power-up.

Is there a way to persist the setting?

BR Marcus

[PhoneBoy]

You'd have to set the immutable flag on the file (using chmod +i).

This will cause the file to not be overwritten.

To modify the file further, you will have to unset the immutable flag. 

[genisis__]

Hi Dameon,

We have a similar requirement, and want to clarify something (or I can raise a TAC case).

- We are using TACACS authentication, but sk105320 only refers to RADIUS, additionally this SK has not been updated since R80.20  (We are running R81.x), how is this done for TACACS?

- Our requirement is to have the fall-back position at the application level ie. Smartconsole login and not via GAIA OS; does the procedure achieve this or is the SK related to GAIA OS only or both?

Update:

I logged a TAC case Sept 9th.  To-date there has been zero progress on this!