That's my AAA model
Hi, folks. I hope that can help begginers to understand better how the AAA model works: http://twitpic.com/ru4za/full And how I implemented that in my case. Hugs. -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Fone@RNP 1015-8902
nice post ... thx On Wed, Dec 2, 2009 at 2:59 PM, Wagner Pereira <wpereira@pop-sp.rnp.br>wrote:
Hi, folks.
I hope that can help begginers to understand better how the AAA model works: http://twitpic.com/ru4za/full
And how I implemented that in my case.
Hugs.
--
Wagner Pereira
PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Fone@RNP 1015-8902
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- ----------------------------------------------------------------- |JJohnny RANDRIAMAMPIONONA | | Phone: +212663682554 | | National School of Applied Sciences | | 1818 TANGIER 90000 | |----------------------------------------------------------------|
Wagner Pereira <wpereira@pop-sp.rnp.br> wrote:
I hope that can help begginers to understand better how the AAA model works: http://twitpic.com/ru4za/full
And how I implemented that in my case.
I only see authentication and accounting in there but no authorisation, you need something like: ---- DEFAULT NAS-Identifier == switch, LDAP-Group == netref Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15" ---- Also the 'top' arrow should probably not say 'SSH session' but 'RADIUS traffic' or something. As a side note, I am pretty sure 'nastype' is deprecated. :) Now go show me why I use the following ;) ---- aaa group server radius lanwarden server 212.219.138.68 auth-port 1812 acct-port 1813 ip radius source-interface Loopback0 aaa authentication dot1x default group lanwarden aaa authorization network default group lanwarden aaa accounting dot1x default start-stop group lanwarden ---- If you are putting some documentation together, make sure you emphasis that there still need to be local accounts on the switch that are consulted *first* as when the RADIUS are unreachable (network routing issue for example) you will be unable to log into your switches: ---- aaa authentication login ssh local group login aaa authorization exec default local group login aaa authorization exec console none aaa accounting exec default start-stop group login ---- Good work never-the-less. Cheers -- Alexander Clouter .sigmonster says: buzzword, n: The fly in the ointment of computer literacy.
Alexander, Thanks for cheered my model. It's updated now: http://twitpic.com/rumfq/full Should I write these lines DEFAULT NAS-Identifier == switch, LDAP-Group == netref Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15" in clients.conf file? By the way, this line aaa authentication login default group radius local that I have written in my Cisco IOS grants my log into it, I guess. -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Fone@RNP 1015-8902 Alexander Clouter escreveu:
Wagner Pereira <wpereira@pop-sp.rnp.br> wrote:
I hope that can help begginers to understand better how the AAA model works: http://twitpic.com/ru4za/full
And how I implemented that in my case.
I only see authentication and accounting in there but no authorisation, you need something like: ---- DEFAULT NAS-Identifier == switch, LDAP-Group == netref Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15" ----
Also the 'top' arrow should probably not say 'SSH session' but 'RADIUS traffic' or something.
As a side note, I am pretty sure 'nastype' is deprecated. :)
Now go show me why I use the following ;) ---- aaa group server radius lanwarden server 212.219.138.68 auth-port 1812 acct-port 1813 ip radius source-interface Loopback0
aaa authentication dot1x default group lanwarden aaa authorization network default group lanwarden aaa accounting dot1x default start-stop group lanwarden ----
If you are putting some documentation together, make sure you emphasis that there still need to be local accounts on the switch that are consulted *first* as when the RADIUS are unreachable (network routing issue for example) you will be unable to log into your switches: ---- aaa authentication login ssh local group login aaa authorization exec default local group login aaa authorization exec console none aaa accounting exec default start-stop group login ----
Good work never-the-less.
Cheers
Wagner Pereira <wpereira@pop-sp.rnp.br> wrote:
Thanks for cheered my model. It's updated now: http://twitpic.com/rumfq/full
Should I write these lines
DEFAULT NAS-Identifier == switch, LDAP-Group == netref Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15"
in clients.conf file?
This is to go in the 'users' file and called from your 'authorize { }' section typically with 'files'. http://wiki.freeradius.org/CONFIGURATION_FILES#USERS
By the way, this line
aaa authentication login default group radius local
that I have written in my Cisco IOS grants my log into it, I guess.
Should probably be: ---- aaa authentication login ssh local group radius aaa authorization exec default local group radius aaa authorization exec console none aaa accounting exec default start-stop group radius ---- Then that way the *local* database of user(s) on the switch is consulted first. Cheers -- Alexander Clouter .sigmonster says: People don't change; they only become more so.
participants (3)
-
Alexander Clouter -
Johnny R -
Wagner Pereira