Dell EqualLogic PS6210XS EqualLogic Group Manager Administrator s Guide PS Ser - Page 60

4. Click Delete and confirm that you want to delete the account. NOTE: Dell recommends that administrator account names not be reused after they have been deleted. All accounts can always view their own audit log information, and new accounts with previously used account names will be able to view audit records for the old account. About RADIUS Accounts If you have a large number of accounts, you can use an external RADIUS server to simplify account management and centralize the management of administration accounts. RADIUS is the abbreviation for Remote Authentication Dial-In User Service, which provides a central authorization and authentication service for all access requests. The RADIUS server authenticates administration accounts and also determines the account privileges. You can also use a RADIUS accounting server to monitor the login and logout times for accounts that a RADIUS server authenticates. If you use Active Directory in your environment, you can also configure the group to use LDAP to authenticate administration accounts. You can grant group, pool, volume administrator, or read-only privileges to individual Active Directory users or to entire Active Directory groups. RADIUS servers are implemented in different ways. Depending on your implementation, a RADIUS server can verify account credentials against a local database, or it can verify them against an external resource such as a Microsoft Windows Active Directory service domain. NOTE: External administration accounts depend on the availability of the RADIUS server and any related resources. If these resources are not available, accounts cannot be authenticated and a login does not succeed. For information about using Active Directory to manage and authenticate administration accounts, see the Technical Report Using Active Directory for Account Authentication to a PS Series Group on the customer support website. For other RADIUS implementations, see your RADIUS server documentation for information about setting up the RADIUS server and configuring vendor-specific attributes (VSAs). You can use multiple RADIUS authentication servers for increased availability. RADIUS Attributes for Administration Accounts A RADIUS server uses attributes to authorize accounts as group administrator, pool administrator, volume administrator, or read-only, and to store account contact information. For security reasons, Dell recommends that you require vendor-specific attributes. See your RADIUS server documentation for information on how to set attributes. For each account, you must set the Service-Type attribute to one of these values: • EQL-Admin-Privilege-Specifies that the account is either a group administrator account, a pool administrator account, or a volume administrator account. If you do not specify the EQL-Admin-Privilege attribute, the account defaults to group administrator. • NAS-Prompt-Specifies that the account is a read-only account. In addition, you must configure vendor-specific attributes (VSAs) for each account if you meet one of these conditions: • You want to create a pool administrator account. You must specify the EQL-Admin-Privilege attribute and the AdminPool-Access attribute. • You want to create a volume administrator account. You must specify the EQL-Admin-Privilege attribute, the AdminPool-Access attribute, and (optionally) the Admin-Repl-Site-Access attribute. NOTE: A replication quota must be included inside the Admin-Repl-Site-Access attribute for authentication to work properly. • You want to create a read-only account. You must specify the EQL-Admin-Privilege attribute and the Admin-AccountType attribute. 60 About Group-Level Security