Considerations when selecting authentication types

Choosing an authentication method for monitoring your infrastructure devices might sound easy at first glance. After all, a monitoring script would only need read-only, right? Wrong.

Monitoring with indeni goes beyond what normal monitoring tools does. The goal of indeni is to detect problems before they occur, saving you hours of troubleshooting and root cause analysis down the road. To get early detection indeni needs access to the advanced shell. Let’s take a look at what this means on F5 devices.

Example: Selecting authentication types for F5 devices

On an F5, having access to the advanced shell means that the user in question must have administrator access. Also, iControl REST requires the user to be locally authenticated up until version 11.5.4. This means that for systems running versions up to 11.5.4 using RADIUS for authentication administrators will have to resort to the local admin account for REST calls.

On top of that if a system has configured authentication and authorization using RADIUS there is no way of setting the shell to advanced shell on any version. So yet again, administrators must resort to the local admin account in order to set the proper permissions.
We have gone above and beyond to avoid using local admin accounts by investing a lot of time running monitor commands via TMSH. However, this has turned out to cause harm to the system due to TMSH using way too much memory. So what does this mean? In order for get the most out of using indeni, administrators will have to configure authentication according to the following table:

[divider width=”full”]

[row style=”collapse”]
[col span=”1/4″ ]
Version
[/col]
[col span=”1/4″ ]
Authentication
[/col]
[col span=”1/4″ ]
Authorization
[/col]
[col span=”1/4″ ]
User
[/col]
[/row]
[row style=”collapse”]

[col span=”1/4″ ]
11.5.4 and earlier
[/col]
[col span=”1/4″ ]
Any
[/col]
[col span=”1/4″ ]
Any[/col]
[col span=”1/4″ ]
Local admin (with SSH access)
[/col]
[/row]
[row style=”collapse”]
[col span=”1/4″ ]
11.6.0 and later
[/col]
[col span=”1/4″ ]
Remote
[/col]
[col span=”1/4″ ]
Remote
[/col]
[col span=”1/4″ ]
Local admin (with SSH access)
[/col]
[/row]
[row style=”collapse”]
[col span=”1/4″ ]
11.6.0 and later
[/col]
[col span=”1/4″ ]
Local
[/col]
[col span=”1/4″ ]
Local
[/col]
[col span=”1/4″ ]
Any account with role Administrator and shell set to Advanced Shell
[/col]
[/row]
[row style=”collapse”]
[col span=”1/4″ ]
11.6.0 and later
[/col]
[col span=”1/4″ ]
Remote
[/col]
[col span=”1/4″ ]
Local
[/col]
[col span=”1/4″ ]
Any account with role Administrator and shell set to Advanced Shell
[/col]
[/row]

[divider width=”full”]

Thank you to Patrik Jonsson for contributing this article.