imRAD N1 Wiki(eng) - User contributions [en]

Command Line Interface (CLI, LYSH)

2021-06-16T06:24:38Z

송재호:

We provide Command Line Interface (CLI), the name is LYSH, which is used for configuring, monitoring, and maintaining the imRAD devices.
The CLI allows you to directly execute commands, whether using a '''console(i.e. Serial Communication)''' or using remote access methods such as '''Secure Shell (SSH, port 22)'''.
{{note|The imRAD device does '''not allow telnet''' access.}}

If you access the console port, the port is located in front of the device and the type is RJ45 connector.
And then, configure the terminal emulation software on your PC for 115,200 baud, 8 data bits, no parity, 1 stop bit, and no flow control.

The default or initial Username and Password are ladmin and 1111 respectively. 
'''If you log in with the default, you must change the default password. If not, you can't access the CLI before changing the password.'''

The CLI has two command line modes: '''user mode and configuration mode'''. By default, user mode is where you begin the session with the imRAD devices. The user mode contains commands that you can use to see logs, the status of services, configurations, system variables and information, and so on. You can run some Linux commands in user mode.

The configuration mode enables to have you can do changes on device configuration such as hostname, Database properties, IP address, nameserver, tiemzone, ntp, ufw, failover, etc. To enter the configuration mode, type the <code>configure</code> command in the user mode.

If press the <tab> key at any time, you can complete the command or see the argument of the command, You can also display "help" by input -h or --help at the end of every command,
<pre>
LYSH@MyHostName# show -h
usage: show [-h] {apache2,command,config,datetime,dci,files,failover,hardware,interface,listen,log,
loghost,multicast,mysql,ntp,php,service,session,system,uptime} ...

show the system information
positional arguments:
apache2 show the status of apache2 service
command show all or related commands
config show config files
datetime show current time and zone
.....
</pre>

If you want to see all commands, enter the <code>show command</code> in the user mode. If you want to find specific commands which include the keyword, enter the <code>show command {keyword}</code>. It shows all commands which contain the keyword.
<pre>
LYSH@MyHostName# show command // list all commands
configure enable config mode
╠══ database Configure database backup or dci property
║ ╠══ backup Configure database backup
║ ║ ╠══ disable disable database backup scheduler
║ ║ ╠══ enable enable database backup scheduler
║ ║ ╠══ hour Configure the starting hour of database backup
║ ║ ╠══ interval Configure the database backup interval in days
...

LYSH@MyHostName# show command ip // search commands which contain "ip"
configure fail2ban Configure the fail2ban(bans IP that makes too many password failures)
configure ip Add/Delete an IP address
configure ip add add an IP address to an ethernet interface.
configure ip delete delete an IP address from an ethernet interface
show multicast show multicast group membership information
</pre>

if you execute <code>show command --linux</code> command, you can see allowed Linux commands.
{{Note| Note that you can not execute commands that are not allowed such as rm, vi, and so on.
}}

<pre>
LYSH@MyHostName# show command linux
a2dismod a2enconf a2dismod a2enmod apt arp awk
cat clear dpkg grep gzip head ifconfig
ip journalctl last lastb lshw lsof ly_dhcpv4
ly_dhcpv6 ly_failover ly_logexp man more mysql mysqldump
mysql_upgrade netsat openssl passwd php phpdismod phpenmod
pidof ping ping6 pmap ps radcrypt radiusd
.....

LYSH@MyHostName# ping
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=110 time=44.6 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=110 time=44.0 ms
.....
</pre>

Attributes

2021-06-16T05:04:19Z

송재호:

__FORCETOC__
=== RADIUS > Attributes ===
Remote Authentication Dial-In User Service (RADIUS) attributes are used to define specific authentication, authorization, and accounting (AAA) elements in a user profile, which are stored on the RADIUS program.

RADIUS Internet Engineering Task Force (IETF) attributes are the original set of 255 standard attributes that are used to communicate AAA information between a client and a server. The IETF attributes are standard and the attribute data is predefined. All clients and servers that exchange AAA information using IETF attributes must agree on attribute data such as the exact meaning of the attributes and the general bounds of the values for each attribute.<ref>https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_radatt/configuration/xe-16/sec-usr-radatt-xe-16-book/sec-rad-ov-ietf-attr.html</ref>

You can search for one or more attributes in this menu.

=== References ===

Accounting

2021-05-07T05:46:21Z

송재호:

There are two RADIUS logs that are the Accounting and Postauth.
The main difference is in which time a log is written. The Accounting log is saving while users are using a network after network access is granted. However, the Postauth is written immediately after processing every ACCESS-REQUEST from users.
For IEEE 802.1X Authenticators, this attribute is used to store the Supplicant MAC address.
Some [[NAS]] devices may not support accounting. Also, depends on the [[NAS]] device, the according may be a little different.

{| class="wikitable"
! style='width:200px' | Items !! style='width:180px' | Attribute name!! Description
|-
| Username|| User-Name || It indicates the name of the user to be authenticated.
|-
| Calling-Station-ID || Calling-Station-Id || This Attribute allows the NAS to send in the Access-Request packet the phone number that the call came from, using Automatic Number Identification (ANI) or similar technology.
For IEEE 802.1X Authenticators, this attribute is used to store the Supplicant MAC address. 
The imRAD saves the Calling-Station-ID after stripping some delimiters, such as "-" or ":".
|-
| Calling-Station-ID(nostrip) || Calling-Station-Id || This is the same as the above except for stripping the delimiters.
|-
| Host IPv4 Address || Framed-IP-Address || It is the IPv4 address of a supplicant.
|-
| Host IPv6 Address || Framed-IPv6-Address || It is the IPv6 address of a supplicant.
|-
| realm || Realm || It is the name of [[Realm and proxy| realm]] in a username.
|-
| NAS || NAS-IP-Address|| It is the IP address of a [[NAS]].
|-
| NAS ID || NAS-Identifier|| It is the the [[NAS Identifier | NAS Identifier]].
|-
| NAS Port ID || NAS-Port-Id || It identifies the port of the NAS which is authenticating the user. This typically matches the interface description.<ref>https://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/rd_naspt.html#wp1066674</ref>
|-
| NAS Port Type || NAS-Port-Type || It indicates the type of physical port the NAS is using to authenticate the user. <ref>https://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/rd_naspt.html#wp1049275</ref>
<ref>https://www.iana.org/assignments/radius-types/radius-types.xhtml#radius-types-13</ref>
|-
| Save Time || - || The date and time that the Accounting was saved in the local database. This value changes whenever the Accounting is received.
|-
| Start Time || - || The first date and time that network access is granted.
|-
| Stop Time || - || The date and time that network access is closed. If this value is blank, it means that the user is still using network.
|-
| Update Time || - || The recent date and time of the Accounting was received.
|-
| Session Time || Acct-Session-Time || This attribute indicates how many seconds the user has received service for.
|-
| Input || Acct-Input-Packets || This attribute indicates how many packets have been received from the port over the course of this service being provided to a Framed User.
|-
| Output|| Acct-Output-Packets || This attribute indicates how many packets have been sent to the port in the course of delivering this service to a Framed User.
|-
| Authentic || Acct-Authentic || It indicates how the user was authenticated and is either RADIUS, Local, or Remote.<ref>https://tools.ietf.org/html/rfc2866#page-16</ref> 
The RADIUS means that a user was authenticated by a RADIUS server. The Local means that a user was authenticated by a NAS.
The Remote means that a user was authenticated by others.
|-
| Interval || Acct-Interim-Interval || It indicates the number of seconds between each interim update in seconds.<ref>https://tools.ietf.org/html/rfc2869#page-36</ref>
|-
| Terminate-Cause|| Acct-Terminate-Cause || It indicates how the session was terminated.<ref>https://tools.ietf.org/html/rfc2866#page-19</ref>
|-
|Called-Station-ID || Called-Station-ID || For IEEE 802.1X Authenticators, this attribute is used to store the bridge or Access Point MAC address.<ref>https://www.oreilly.com/library/view/radius/0596003226/re07.html</ref><ref>https://tools.ietf.org/html/rfc2865#page-50</ref>
|-
| Service Type || Service-Type || This Attribute indicates the type of service the user has requested, or the type of service to be provided.<ref>https://tools.ietf.org/html/rfc2865#page-31</ref>
|-
| 연결 시작 형태 연결 중지 형태 || Connect-Info || This attribute is sent from the NAS to indicate the nature of the user's connection.<ref>https://tools.ietf.org/html/rfc2869#page-30</ref>
|-
|}

=== References ===

Accounting

2021-05-07T05:43:17Z

송재호:

There are two RADIUS logs that are the Accounting and Postauth.
The main difference is in which time a log is written. The Accounting log is saving while users are using a network after network access is granted. However, the Postauth is written immediately after processing every ACCESS-REQUEST from users.
For IEEE 802.1X Authenticators, this attribute is used to store the Supplicant MAC address.
Some [[NAS]] devices may not support the accounting. Also, depends on the [[NAS]] device, the according may be a little different.

{| class="wikitable"
! style='width:200px' | Items !! style='width:180px' | Attribute name!! Description
|-
| Username|| User-Name || It indicates the name of the user to be authenticated.
|-
| Calling-Station-ID || Calling-Station-Id || This Attribute allows the NAS to send in the Access-Request packet the phone number that the call came from, using Automatic Number Identification (ANI) or similar technology.
For IEEE 802.1X Authenticators, this attribute is used to store the Supplicant MAC address. 
The imRAD saves the Calling-Station-ID after stripping some delimiters, such as "-" or ":".
|-
| Calling-Station-ID(nostrip) || Calling-Station-Id || This is the same as the above except for stripping the delimiters.
|-
| Host IPv4 Address || Framed-IP-Address || It is the IPv4 address of a supplicant.
|-
| Host IPv6 Address || Framed-IPv6-Address || It is the IPv6 address of a supplicant.
|-
| realm || Realm || It is the name of [[Realm and proxy| realm]] in a username.
|-
| NAS || NAS-IP-Address|| It is the IP address of a [[NAS]].
|-
| NAS ID || NAS-Identifier|| It is the the [[NAS Identifier | NAS Identifier]].
|-
| NAS Port ID || NAS-Port-Id || It identifies the port of the NAS which is authenticating the user. This typically matches the interface description.<ref>https://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/rd_naspt.html#wp1066674</ref>
|-
| NAS Port Type || NAS-Port-Type || It indicates the type of physical port the NAS is using to authenticate the user. <ref>https://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/rd_naspt.html#wp1049275</ref>
<ref>https://www.iana.org/assignments/radius-types/radius-types.xhtml#radius-types-13</ref>
|-
| Save Time || - || The date and time that the Accounting was saved in the local database. This value changes whenever the Accounting is received.
|-
| Start Time || - || The first date and time that network access is granted.
|-
| Stop Time || - || The date and time that network access is closed. If this value is blank, it means that the user is still using network.
|-
| Update Time || - || The recent date and time of the Accounting was received.
|-
| Session Time || Acct-Session-Time || This attribute indicates how many seconds the user has received service for.
|-
| Input || Acct-Input-Packets || This attribute indicates how many packets have been received from the port over the course of this service being provided to a Framed User.
|-
| Output|| Acct-Output-Packets || This attribute indicates how many packets have been sent to the port in the course of delivering this service to a Framed User.
|-
| Authentic || Acct-Authentic || It indicates how the user was authenticated and is either RADIUS, Local, or Remote.<ref>https://tools.ietf.org/html/rfc2866#page-16</ref> 
The RADIUS means that a user was authenticated by a RADIUS server. The Local means that a user was authenticated by a NAS.
The Remote means that a user was authenticated by others.
|-
| Interval || Acct-Interim-Interval || It indicates the number of seconds between each interim update in seconds.<ref>https://tools.ietf.org/html/rfc2869#page-36</ref>
|-
| Terminate-Cause|| Acct-Terminate-Cause || It indicates how the session was terminated.<ref>https://tools.ietf.org/html/rfc2866#page-19</ref>
|-
|Called-Station-ID || Called-Station-ID || For IEEE 802.1X Authenticators, this attribute is used to store the bridge or Access Point MAC address.<ref>https://www.oreilly.com/library/view/radius/0596003226/re07.html</ref><ref>https://tools.ietf.org/html/rfc2865#page-50</ref>
|-
| Service Type || Service-Type || This Attribute indicates the type of service the user has requested, or the type of service to be provided.<ref>https://tools.ietf.org/html/rfc2865#page-31</ref>
|-
| 연결 시작 형태 연결 중지 형태 || Connect-Info || This attribute is sent from the NAS to indicate the nature of the user's connection.<ref>https://tools.ietf.org/html/rfc2869#page-30</ref>
|-
|}

=== References ===

File:추가범위2.png

2020-11-13T05:02:14Z

송재호: MsUpload로 파일을 올림

MsUpload로 파일을 올림