ClearBox TACACS+ and RADIUS Server for Windows is an application for the centralized control and management of remote access to a network through the use of the widely applicable RADIUS and TACACS+ protocols. Providing central user access and security administration, ClearBox Server is a full-featured, flexible server with the rich set of capabilities. It has everything you need to start using the server right after installing it.

TACACS Server Mode

TACACS Server offers an outstanding flexibility with multiple AAA policies. Each authentication, authorization, or accounting policy may be selected by a user domain, its membership in a domain group, or a requested privilege level or service.

It allows to implement so-called access matrix. Suppose, a company grants different access levels to its network equipment (routers, gateways, etc.) looking at a user group membership. It can be described with this table:

Authentication

ClearBox is capable to authenticate users against Windows domains or workgroups and SQL databases. Moreover, it can authenticate against LDAP directories. It is extremely useful when Active Directory authentication should be established, but ClearBox machine is not a domain member.

Authorization and Accounting

ClearBox offers two ways to control user authorization, i.e. what he is allowed when connected to the network:

• Service authorization: you may explicitly define what services (shell, ip, lcp, etc.) are allowed.
• Command authorization (for shell service): what commands are granted or prohibited on a network server (primarily, on Cisco boxes).

ClearBox also tracks and limits number of concurrent user sessions. Accounting options include logging to a database or a file, with command accounting SQL script pre-installed.

NAS's may be gathered in logical groups, and these groups may participate in authentication and authorization processes.

RADIUS Server Mode

ClearBox supports an unlimited number of policies chosen by a RADIUS client address, a set of request attributes or a user domain. Any policy is independent and allows to:

• Proxy-forward RADIUS requests to a remote RADIUS server;
• Authenticate network users against Windows 2000/2003 domains and workgroups, Windows 2000/2003 Active Directory, MS SQL Server, MS Access, MySQL and other ODBC and OLE DB data sources;
• Apply any authorization filters, such as authorize by DNIS, MAC address, requested service. These filters may be static or loaded from a database for each user;
• Assign any attributes to a user connection, both static and database-driven;
• Forward accounting request to remote RADIUS servers, log accounting data to a SQL database table or a file in CSV or Livingston format.

ClearBox can be integrated in any existing environment, as it uses editable SQL commands instead of hard-coded queries.

Advanced features of ClearBox include double-logon prevention, tracking the users currently logged onto the network, integration with the billing systems, rewriting user names and many others.

---- -------- --------- ---------- -------- ---------- --------- ---------- ---------- -------- -------- ----- ----- ---------- ------- -------- ------------ ------ ---- ------ ---- ------ ----- ---- ----------- ------------