Network Device Authentication System (RADIUS + REST + Valkey)

This project implements a secure, automated authentication workflow for network devices using a RADIUS server backed by a REST API and Valkey. It supports both manual logins and seamless SSH access via SSH_ASKPASS.

Architecture Overview

1. Network Device: Request authentication via RADIUS (PAP).
2. RADIUS Server: Executes a local script to validate credentials.
3. REST API (Gunicorn):
   • Listens on a Unix Socket for security.
   • Manages user secrets in Valkey.
   • Generates/validates OTP-style passwords.
   • Client SSH: Uses SSH_ASKPASS to fetch the OTP from the API automatically for a passwordless experience.

Components

1. REST API & Valkey Backend

The API serves as the bridge between the authentication requests and the secret storage.

• Endpoint GET /otp: Takes a username, retrieves/creates a secret in Valkey with TTL, and returns a time-based OTP.
• Security: The API is hosted via Gunicorn and bound to a Unix socket, restricting access to local system users.

2. RADIUS Integration

The RADIUS server (e.g., FreeRADIUS) is configured to use an external "exec" module:

• The script calls the local REST API via the Unix socket.
• It compares the password provided by the network device with the OTP generated by the API.

3. Client-Side Automation (SSH_ASKPASS)

To allow users to SSH into devices without typing passwords:

• A helper script is provided to call the REST API.
• The SSH_ASKPASS environment variable is set to this script. Usage:

  export SSH_ASKPASS='/path/to/ssh-otp.sh'
  setsid ssh user@network-device
  

Security Features

• Dynamic Secrets: Secrets are generated on-demand in Valkey if they do not exist.
• No Static Passwords: All authentication uses short-lived OTPs.
• Local Isolation: The authentication API is not exposed to the network, only to the RADIUS process via Unix sockets.