<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="PersonName"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";
mso-believe-normal-left:yes;}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
color:black;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
<![if mso 9]>
<style>
p.MsoNormal
{margin-left:3.35pt;}
</style>
<![endif]>
</head>
<body lang=EN-US link=blue vlink=blue style='margin-left:3.35pt;margin-top:
3.35pt;margin-right:3.35pt;margin-bottom:.85pt'>
<div class=Section1>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>Authentication with ntlm-auth and “require-membership-of”
works well for us. Right now we simply authenticate the login/vty session
with AD, and the secret is “authorized” locally by the switch.
So, each person gets the vty session with their own unique credentials
validated via ntlm-auth and AD. Everyone knows the secret password.
Works well. On our “dev” FR instance I have an FR users file
to return various Cisco attribute-value pairs. This works well too.
Somewhere down the road I’ll go for a full authorization process with AD
on the back side, or since a relatively small number of users access our gear,
might just stick to users file. Guess it depends how skilled I get with
LDAP/AD/unlang/whatever else…<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'>G<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='margin:0in;margin-bottom:.0001pt;
text-align:center'><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org
[mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org] <b><span
style='font-weight:bold'>On Behalf Of </span></b>Brett Littrell<br>
<b><span style='font-weight:bold'>Sent:</span></b> Wednesday, February 09, 2011
9:57 AM<br>
<b><span style='font-weight:bold'>To:</span></b> <st1:PersonName w:st="on">FreeRadius
users mailing list</st1:PersonName><br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: Authenticating SSH
login on a Cisco IOS switch to AD</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'>Hi Chris,<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'>
We use TACACS+ to administer our switches here and I can tell you that I had to
add extra stuff to the TACACS replies to allow authorization to manage the
switches. So you may be able to login via radius but somewhere you are
going to have to send information to the switch on what authorization is given
per user. This means that your going to have to have AD respond with this
information or have some other method that will inject those values when you
login.<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'>
I think it is possible but I do not think it will be to easy if you are only
using AD as the back-end, you may need to use local files to define groups with
attributes or some scripts to inject the values Cisco wants.<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'>Hope that
helps.<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'> <o:p></o:p></span></font></p>
</div>
<div>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'>Brett
Littrell<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'>Network
Manager<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'>MUSD<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'>CISSP,
CCSP, CCVP, MCNE<o:p></o:p></span></font></p>
</div>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=2
face="Segoe UI"><span style='font-size:10.0pt;font-family:"Segoe UI"'><br>
<br>
>>> On Wednesday, February 09, 2011 at 7:24 AM, in message
<604AAF035805AB46B4F293945AE8F9FC182FEB879C@pzex01-07>,
"Schaatsbergen, Chris" <Chris.Schaatsbergen@aleo-solar.de>
wrote:<o:p></o:p></span></font></p>
</div>
<table class=MsoNormalTable border=0 cellpadding=0 bgcolor="#F3F3F3"
style='margin-left:12.55pt;background:#F3F3F3'>
<tr>
<td style='padding:.75pt .75pt .75pt .75pt'>
<div style='border:none;border-left:solid #050505 1.0pt;padding:0in 0in 0in 6.0pt'>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>Greetings all,<br>
<br>
We have a couple of Cisco switches that we administer using SSH sessions. Now
I have been asked if we can authenticate the SSH login on our Windows 2008
Active Directory using our Freeradius (2.1.10) installation.<br>
<br>
I have been looking and found:<br>
<a href="http://wiki.freeradius.org/Cisco">http://wiki.freeradius.org/Cisco</a><br>
for authenticating inbound shell users and <br>
<a
href="http://deployingradius.com/documents/configuration/active_directory.html">http://deployingradius.com/documents/configuration/active_directory.html</a><br>
for authenticating users on AD.<br>
<br>
Now I am trying to combine those two. <br>
<br>
On the Freeradius server Samba and Kerberos are configured, the ntlm_auth
returns an NT_STATUS_OK.<br>
<br>
First question: Would this at all be possible?<br>
<br>
And if so my second question: Unfortunately, when I add ntlm_auth to the
authenticate section of sites-enabled/default and run freeradius -X I get an
error that the ntlm_auth module could not be loaded though I have created the
ntlm_auth file in the modules folder as described in the link. How should I
get that to work?<br>
<br>
Help would be highly appreciated.<br>
<br>
Chris Schaatsbergen<br>
<br>
-<br>
List info/subscribe/unsubscribe? See <a
href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><o:p></o:p></span></font></p>
</div>
</td>
</tr>
</table>
<p class=MsoNormal style='margin:0in;margin-bottom:.0001pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'><o:p> </o:p></span></font></p>
</div>
<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>
</body>
</html>