Conductor Managed SSR to use TACACS/Radius/LDAP for remote login (ssh) authentication.

How to configure SSR to use TACACS/Radius/LDAP for remote login (ssh) authentication for Conductor Managed use cases

Detailed configuration is available at https://docs.128technology.com/docs/config_radius/

The configured ldap/radius will extend it to all managed routers under the conductor as well however, these managed routers should be able to reach the configured server addresses from the _internal_ tenant which is extended to the system OS

Now SSR RADIUS  needs Vendor Specfic Attribute to be returned by the RADIUS server for users of the SSR and this attribute will be provided to the SSR to be used to create the user based on a pre-configured user template.
 
For users that aren’t configured locally, the SSR will use a RADIUS attribute Juniper-Local-User-Name Juniper vendor-specific attribute 2636 (type 1, string) to identify a user template configured on the SSR to create a local linux user
If the user is configured on the SSR the existing locally administered, remotely authenticated model will still function. In a case of conflict between the VSA template and local user policy the local user policy will take precedence
 
Free Radius Server Configuration
 
Update the following in /etc/freeradius/3.0/dictionary
 
VENDOR Juniper 2636
BEGIN-VENDOR Juniper
ATTRIBUTE Juniper-Local-User-Name 1 string
END-VENDOR Juniper
 
Create a user in /etc/freeradius/3.0/users
 
<user-name>    Cleartext-Password := "xxxx"
                  Juniper-Local-User-Name = "128t-admin",
                  Reply-Message = "Hello, %{User-Name}"
 
Create the NAS both Conductor and Routers in Clients
 
client SCB-CON {
    ipaddr = X.X.X.X
    secret = xxxx
}
 
client SSR {
    ipaddr = X.X.X.X
    secret = xxxx
}