<HTML><HEAD>
<META content="text/html; charset=iso-8859-15" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.7600.16671"></HEAD>
<BODY style="MARGIN: 4px 4px 1px; FONT: 10pt Segoe UI">
<DIV>Hi Chris,</DIV>
<DIV> </DIV>
<DIV> We use TACACS+ to administer our switches here and I can tell you that I had to add extra stuff to the TACACS replies to allow authorization to manage the switches. So you may be able to login via radius but somewhere you are going to have to send information to the switch on what authorization is given per user. This means that your going to have to have AD respond with this information or have some other method that will inject those values when you login.</DIV>
<DIV> </DIV>
<DIV> I think it is possible but I do not think it will be to easy if you are only using AD as the back-end, you may need to use local files to define groups with attributes or some scripts to inject the values Cisco wants.</DIV>
<DIV> </DIV>
<DIV>Hope that helps.</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>
<DIV>Brett Littrell</DIV>
<DIV>Network Manager</DIV>
<DIV>MUSD</DIV>
<DIV>CISSP, CCSP, CCVP, MCNE</DIV><BR><BR>>>> On Wednesday, February 09, 2011 at 7:24 AM, in message <604AAF035805AB46B4F293945AE8F9FC182FEB879C@pzex01-07>, "Schaatsbergen, Chris" <Chris.Schaatsbergen@aleo-solar.de> wrote:<BR></DIV>
<TABLE style="MARGIN: 0px 0px 0px 15px; FONT-SIZE: 1em" border=0 bgColor=#f3f3f3>
<TBODY>
<TR>
<TD>
<DIV style="BORDER-LEFT: #050505 1px solid; PADDING-LEFT: 7px">Greetings all,<BR><BR>We have a couple of Cisco switches that we administer using SSH sessions. Now I have been asked if we can authenticate the SSH login on our Windows 2008 Active Directory using our Freeradius (2.1.10) installation.<BR><BR>I have been looking and found:<BR><A href="http://wiki.freeradius.org/Cisco">http://wiki.freeradius.org/Cisco</A><BR>for authenticating inbound shell users and <BR><A href="http://deployingradius.com/documents/configuration/active_directory.html">http://deployingradius.com/documents/configuration/active_directory.html</A><BR>for authenticating users on AD.<BR><BR>Now I am trying to combine those two. <BR><BR>On the Freeradius server Samba and Kerberos are configured, the ntlm_auth returns an NT_STATUS_OK.<BR><BR>First question: Would this at all be possible?<BR><BR>And if so my second question: Unfortunately, when I add ntlm_auth to the authenticate section of sites-enabled/default and run freeradius -X I get an error that the ntlm_auth module could not be loaded though I have created the ntlm_auth file in the modules folder as described in the link. How should I get that to work?<BR><BR>Help would be highly appreciated.<BR><BR>Chris Schaatsbergen<BR><BR>-<BR>List info/subscribe/unsubscribe? See <A href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</A><BR></DIV></TD></TR></TBODY></TABLE></BODY></HTML>