Keycyte PAM 3.2 · Administrator Guide

Configuring the RADIUS Server

Keycyte PAM includes a RADIUS server. Network access devices (RADIUS clients, also called NAS), such as VPN gateways, firewalls and wireless controllers, can send their sign-in requests to it. The RADIUS server authenticates the user with the same chain as the Keycyte PAM sign-in page (local users, RADIUS, LDAP/Active Directory) and asks for the user’s MFA code when MFA is enabled.

The RADIUS server runs as a separate Keycyte PAM service. You can see its state and restart it on the Services page.

To open the page, select Settings > Radius Server. If the server has not been configured yet, the page says so; fill in the settings and save them.

Configuring the RADIUS Server

To configure the server:

1. Specify the following settings:

   Field	Description
   Listen Port	UDP port the server listens on. Default: 1812.
   Shared Secret	Secret shared with the RADIUS clients. Leave it empty to keep the current secret.
   MFA Timeout (seconds)	How long the server waits for the user’s MFA code, 30 to 600. Default: 180.
   Max Failed Attempts	Number of failed attempts allowed, 1 to 10. Default: 3.
   Session Timeout (seconds)	10 to 3600. Default: 30.
   Allowed NAS IPs	Comma-separated addresses of the devices allowed to send requests, for example 10.0.0.1, 10.0.0.2. Leave it empty to allow all.
   Log Level	DEBUG, INFO (default) or ERROR.
   Description	Free-text note.

2. Click Save.

3. On each network device, add Keycyte PAM as a RADIUS server with the address of the Keycyte PAM server, the listen port and the shared secret.