<div dir="ltr"><div>Sorry for the spam, but.. I forgot a part in my current "user add" process:</div>
<div> </div>
<div>I then have to have the user login via SSH (after having them download Putty) so that they can change their password. Then, I have to disallow them access to SSH (because they shouldn't be logging directly into the servers). <br>
<br></div>
<div class="gmail_quote">On Fri, Sep 5, 2008 at 10:41 PM, Jesse Stone <span dir="ltr"><<a href="mailto:jstone1999@gmail.com">jstone1999@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div dir="ltr">
<div>Would Freeradius be the correct technology for this? </div>
<div> </div>
<div>For example, </div>
<div> </div>
<div>Currently, for me to allow someone access to my OpenVPN server and Samba I have to first add them as a standard user with the useradd script. Then I have use smbpasswd -e to enable their account for Samba. If I wanted that user to also be able to SSH into another server I would have to repeat this process. After about 3 users I forgot who has access to what. This is the process I want to simply. I want 1 place/script that prompts for every app/server that I want to restrict access to: Samba, SSH, Shell access, X, ect. I want this infromation stored in a standard SQL type database though so I can easilly manipulate users once they've been created on the fly. Perferrably within 1 table like a provided in my last email for an example simple user management style.</div>
<div> </div>
<div>What do large companies that have many users/linux machines use to handle user administration?</div>
<div> </div><font color="#888888">
<div>-Jesse</div></font>
<div>
<div></div>
<div class="Wj3C7c">
<div><br> </div>
<div class="gmail_quote">On Fri, Sep 5, 2008 at 5:30 PM, Edvin Seferovic <span dir="ltr"><<a href="mailto:edvin.seferovic@kolp.at" target="_blank">edvin.seferovic@kolp.at</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div lang="DE" vlink="purple" link="blue">
<div>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d">It is a tricky concept, but it can be done with a lot of effort. Probably not for all applications ( since it doesn't make any sense for some of them ). Maybe you should consider making a real network DMZ. The concept of DMZ allows you to define and allow/disallow access to services from the Internet and those from the local LAN. You DO NOT make things or services available "to the DMZ" !</span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d"> </span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d">Start simple !</span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d"> </span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d">Regards,</span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d">E:S</span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d"> </span></p>
<div style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0cm; BORDER-TOP: #b5c4df 1pt solid; PADDING-LEFT: 0cm; PADDING-BOTTOM: 0cm; BORDER-LEFT: medium none; PADDING-TOP: 3pt; BORDER-BOTTOM: medium none">
<p><b><span lang="EN-US" style="FONT-SIZE: 10pt">From:</span></b><span lang="EN-US" style="FONT-SIZE: 10pt"> freeradius-users-bounces+edvin.seferovic=<a href="http://kolp.at/" target="_blank">kolp.at</a>@<a href="http://lists.freeradius.org/" target="_blank">lists.freeradius.org</a> [mailto:<a href="mailto:freeradius-users-bounces%2Bedvin.seferovic" target="_blank">freeradius-users-bounces+edvin.seferovic</a>=<a href="http://kolp.at/" target="_blank">kolp.at</a>@<a href="http://lists.freeradius.org/" target="_blank">lists.freeradius.org</a>] <b>On Behalf Of </b>Jesse Stone<br>
<b>Sent:</b> Samstag, 06. September 2008 01:50
<div><br><b>To:</b> FreeRadius users mailing list<br></div><b>Subject:</b> Re: Freeradius Usage</span>
<p></p>
<p></p></p></div>
<div>
<div></div>
<div>
<p> </p>
<div>
<div>
<p>Thank you for the quick response. I may not have mentioned this previously but I am by no means a linux/networking expert. The company I work for is pro-MS. Recently, I got the urge to get back into Linux and here I am. </p>
</div>
<div>
<p> </p></div>
<div>
<p>My thinking (in regards to network structure) was that I wanted applications intended to the public as far away from my local lan as posible. The local lan requires the app server though- OpenVPN, Samba (as a PDC), misc other things so I wanted it available to the local lan but not to the DMZ.</p>
</div>
<div>
<p> </p></div>
<div>
<p>My main questions though are with Freeradius. My setup is for "hobby" purposes only and already I would have difficulty telling you exactly which users have access to what.</p></div>
<div>
<p> </p></div>
<div>
<p>I want to using a technology like Freeradius or LDAP create 1 central place on the app server that EVERYTHING would authenication to. In a perfect world, the end result would be that I could type something like this:</p>
</div>
<div>
<p> </p></div>
<div>
<p>select %user% from permissionsDB</p></div>
<div>
<p> </p></div>
<div>
<p>and be returned something like this:</p></div>
<div>
<p> </p></div>
<div>
<p>SSH: NO, OpenVPN: YES, Samba: %Specific group% (which indicates shares available), Shell Access: No, ect</p></div>
<div>
<p> </p></div>
<div>
<p>Basically, I want a setup where I can easilly scale upwards without having to "teach" each new application how to use a DB. Freeradious also can authenicate my wireless users when would also be great as for all I know, half my bandwidth is being used by my neighbors.</p>
</div>
<div>
<p> </p></div>
<div>
<p style="MARGIN-BOTTOM: 12pt">-Jesse</p></div>
<div>
<p>On Fri, Sep 5, 2008 at 4:34 PM, Edvin Seferovic <<a href="mailto:edvin.seferovic@kolp.at" target="_blank">edvin.seferovic@kolp.at</a>> wrote:</p>
<div>
<div>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d">Hi,</span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d"> </span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d">excuse me for asking, but why dont you set up the AppServer in your DMZ ? you could have ( what I call ) the T – structure</span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d"> </span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d">>< --- INTERNET --> GATEWAY ( server1 ) <---> LOCAL LAN</span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d"> I</span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d"> I DMZ</span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d"> I</span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d"> SERVER2 + APPServer</span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d"> </span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d">It depends how your users use the gateway and how are they suppose to connect to the Internet. </span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d"> </span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d">Regards,</span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d">E:S</span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d"> </span></p>
<p><span lang="EN-US" style="FONT-SIZE: 11pt; COLOR: #1f497d"> </span></p>
<div style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0cm; BORDER-TOP: #b5c4df 1pt solid; PADDING-LEFT: 0cm; PADDING-BOTTOM: 0cm; BORDER-LEFT: medium none; PADDING-TOP: 3pt; BORDER-BOTTOM: medium none">
<p><b><span lang="EN-US" style="FONT-SIZE: 10pt">From:</span></b><span lang="EN-US" style="FONT-SIZE: 10pt"> freeradius-users-bounces+edvin.seferovic=<a href="http://kolp.at/" target="_blank">kolp.at</a>@<a href="http://lists.freeradius.org/" target="_blank">lists.freeradius.org</a> [mailto:<a href="mailto:freeradius-users-bounces%2Bedvin.seferovic" target="_blank">freeradius-users-bounces+edvin.seferovic</a>=<a href="http://kolp.at/" target="_blank">kolp.at</a>@<a href="http://lists.freeradius.org/" target="_blank">lists.freeradius.org</a>] <b>On Behalf Of </b>Jesse Stone<br>
<b>Sent:</b> Samstag, 06. September 2008 01:25<br><b>To:</b> FreeRadius users mailing list<br><b>Subject:</b> Freeradius Usage</span></p></div>
<div>
<div>
<p> </p>
<div>
<div>
<p>Hi All,</p></div>
<div>
<p> </p></div>
<div>
<p>I am new to this mailing list and am about to ask a probably very silly question. Please feel free to direct me to resources that'll help me answer them.</p></div>
<div>
<p> </p></div>
<div>
<p>I want to setup the following:</p></div>
<div>
<p> </p></div>
<div>
<p>Gateway [server1]</p></div>
<div>
<p> - nic1 = Internet</p></div>
<div>
<p> - nic2 = DMZ [server2]</p></div>
<div>
<p> - nic3 = Router w/ Wireless -> App Server [Server3] (FREERADIUS SERVER HERE) -> Local Lan</p></div>
<div>
<p> </p></div>
<div>
<p>I read a lot about both Freeradius and LDAP and cannot determine if either can accomplish my goals.</p></div>
<div>
<p> </p></div>
<div>
<p>What I want is:</p></div>
<div>
<p> </p></div>
<div>
<p>1) 1 central place where all user authenication takes place: SSH, Shell Access, Samba, OpenVPN, Mumble, Any other app that requires user administration.</p></div>
<div>
<p>2) This information stored in a SQL type database so that I can build my own custom apps to report on user usage, performance ect.</p></div>
<div>
<p>3) My router has wireless and I have enabled the security features. I would still like authenication to take place before a wireless user is allowed on the network.</p></div>
<div>
<p> </p></div>
<div>
<p>For example, </p></div>
<div>
<p> </p></div>
<div>
<p>Currently, I have this: Router w/ Wireless -> App Server [Server3] + Local Lan</p></div>
<div>
<p> </p></div>
<div>
<p>I want this: Router w/ Wireless -> App Server [Server3] -> Local Lan</p></div>
<div>
<p> </p></div>
<div>
<p>Is Freeradius the best approach for my needs? Do I need anything else? </p></div>
<div>
<p> </p></div>
<div>
<p>-Jesse</p></div>
<div>
<p> </p></div></div></div></div></div></div>
<p><br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a></p></div>
<p> </p></div></div></div></div></div><br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div>
<br></div></div></div></blockquote></div><br></div>