<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252"><meta name="Generator" content="Microsoft Word 12 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";
mso-believe-normal-left:yes;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal;
color:black;}
span.E-MailFormatvorlage18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><![if mso 9]><style>p.MsoNormal
{margin-left:3.35pt;}
</style><![endif]><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang="NL" link="blue" vlink="blue" style="margin-left:3.35pt;margin-top:3.35pt;margin-right:3.35pt;margin-bottom:.85pt"><font style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">
That's fine. I'm refreshing myself on our confs this morn, so I'll be able to help you more effeciently after that. In the mean time ensure your SAMBA works, that can take a little work. Also, obtain the SID of the AD group you want to check membership of. NTLM_AUTH says it can use the group "name", but I tried several different syntax and could only get it working with the SID.</font><br> <br>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<font style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
<b>From</b>: Schaatsbergen, Chris [mailto:Chris.Schaatsbergen@aleo-solar.de]
<br><b>Sent</b>: Thursday, February 10, 2011 05:31 AM<br><b>To</b>: FreeRadius users mailing list <freeradius-users@lists.freeradius.org>
<br><b>Subject</b>: AW: Authenticating SSH login on a Cisco IOS switch to AD
<br></font> <br></div>
<div class="WordSection1"><p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Gary<o:p></o:p></span></p><p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Would you mind if I contacted you directly (I have your e-mail) about this? I have seen a very nice discussion and reading this a second time has proven that what you describe here is exactly what we are looking for. But I would still really appreciate some help getting it to work.<o:p></o:p></span></p><p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks,<o:p></o:p></span></p><p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Chris<o:p></o:p></span></p><div style="border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt"><div><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><b><span lang="DE" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">Von:</span></b><span lang="DE" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> freeradius-users-bounces+chris.schaatsbergen=aleo-solar.de@lists.freeradius.org [mailto:freeradius-users-bounces+chris.schaatsbergen=aleo-solar.de@lists.freeradius.org] <b>Im Auftrag von </b>Gary Gatten<br><b>Gesendet:</b> Mittwoch, 9. Februar 2011 17:11<br><b>An:</b> 'FreeRadius users mailing list'<br><b>Betreff:</b> RE: Authenticating SSH login on a Cisco IOS switch to AD<o:p></o:p></span></p></div></div><p class="MsoNormal"><o:p> </o:p></p><p class="MsoNormal"><span lang="EN-US" style="color:black">Authentication with ntlm-auth and “require-membership-of” works well for us. Right now we simply authenticate the login/vty session with AD, and the secret is “authorized” locally by the switch. So, each person gets the vty session with their own unique credentials validated via ntlm-auth and AD. Everyone knows the secret password. Works well. On our “dev” FR instance I have an FR users file to return various Cisco attribute-value pairs. This works well too. Somewhere down the road I’ll go for a full authorization process with AD on the back side, or since a relatively small number of users access our gear, might just stick to users file. Guess it depends how skilled I get with LDAP/AD/unlang/whatever else…<o:p></o:p></span></p><p class="MsoNormal"><span lang="EN-US" style="color:black">G<o:p></o:p></span></p><p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p><p class="MsoNormal"><span lang="EN-US" style="color:black"><o:p> </o:p></span></p><div><div class="MsoNormal" align="center" style="margin:0cm;margin-bottom:.0001pt;text-align:center"><span lang="EN-US"><hr size="2" width="100%" align="center"></span></div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org] <b>On Behalf Of </b>Brett Littrell<br><b>Sent:</b> Wednesday, February 09, 2011 9:57 AM<br><b>To:</b> FreeRadius users mailing list<br><b>Subject:</b> Re: Authenticating SSH login on a Cisco IOS switch to AD</span><span lang="EN-US"><o:p></o:p></span></p></div><p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif"">Hi Chris,<o:p></o:p></span></p></div><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif""> <o:p></o:p></span></p></div><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif""> We use TACACS+ to administer our switches here and I can tell you that I had to add extra stuff to the TACACS replies to allow authorization to manage the switches. So you may be able to login via radius but somewhere you are going to have to send information to the switch on what authorization is given per user. This means that your going to have to have AD respond with this information or have some other method that will inject those values when you login.<o:p></o:p></span></p></div><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif""> <o:p></o:p></span></p></div><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif""> I think it is possible but I do not think it will be to easy if you are only using AD as the back-end, you may need to use local files to define groups with attributes or some scripts to inject the values Cisco wants.<o:p></o:p></span></p></div><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif""> <o:p></o:p></span></p></div><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif"">Hope that helps.<o:p></o:p></span></p></div><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif""> <o:p></o:p></span></p></div><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif""> <o:p></o:p></span></p></div><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif""> <o:p></o:p></span></p></div><div><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif"">Brett Littrell<o:p></o:p></span></p></div><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif"">Network Manager<o:p></o:p></span></p></div><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif"">MUSD<o:p></o:p></span></p></div><div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif"">CISSP, CCSP, CCVP, MCNE<o:p></o:p></span></p></div><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:10.0pt;font-family:"Segoe UI","sans-serif""><br><br>>>> On Wednesday, February 09, 2011 at 7:24 AM, in message <604AAF035805AB46B4F293945AE8F9FC182FEB879C@pzex01-07>, "Schaatsbergen, Chris" <Chris.Schaatsbergen@aleo-solar.de> wrote:<o:p></o:p></span></p></div><table class="MsoNormalTable" border="0" cellpadding="0" style="margin-left:12.55pt;background:#F3F3F3"><tr><td style="padding:.75pt .75pt .75pt .75pt"><div style="border:none;border-left:solid #050505 1.0pt;padding:0cm 0cm 0cm 6.0pt"><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt">Greetings all,<br><br>We have a couple of Cisco switches that we administer using SSH sessions. Now I have been asked if we can authenticate the SSH login on our Windows 2008 Active Directory using our Freeradius (2.1.10) installation.<br><br>I have been looking and found:<br><a href="http://wiki.freeradius.org/Cisco">http://wiki.freeradius.org/Cisco</a><br>for authenticating inbound shell users and <br><a href="http://deployingradius.com/documents/configuration/active_directory.html">http://deployingradius.com/documents/configuration/active_directory.html</a><br>for authenticating users on AD.<br><br>Now I am trying to combine those two. <br><br>On the Freeradius server Samba and Kerberos are configured, the ntlm_auth returns an NT_STATUS_OK.<br><br>First question: Would this at all be possible?<br><br>And if so my second question: Unfortunately, when I add ntlm_auth to the authenticate section of sites-enabled/default and run freeradius -X I get an error that the ntlm_auth module could not be loaded though I have created the ntlm_auth file in the modules folder as described in the link. How should I get that to work?<br><br>Help would be highly appreciated.<br><br>Chris Schaatsbergen<br><br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><o:p></o:p></p></div></td></tr></table><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US"><o:p> </o:p></span></p><p class="MsoNormal" style="margin:0cm;margin-bottom:.0001pt"><span lang="EN-US" style="font-size:7.5pt">"This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </span><span lang="EN-US"><o:p></o:p></span></p></div></div>
<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
and may contain information that is privileged and/or confidential.
If you are not the intended recipient, you are hereby notified that
any review, use, dissemination, disclosure or copying of this email
and its attachments, if any, is strictly prohibited. If you have
received this email in error, please immediately notify the sender by
return email and delete this email from your system."
</font>
</body></html>