Help Needed !!! FreeRADIUS Integration with MS AD
Hi Team, I need a help, am new to RADIUS and i need the below to be configured. I. FreeRADIUS integration with Microsoft AD II. Cisco switches needs to be the client II. The accounting information should also contain the commands executed in the Switch as well, Example If a used called "test" login to the switch and exexuted a command "Show config" that should be captured in the accounting information. What i have done till now is configured FreeRADIUS and created some local users and getting the switch to authenticated against the local user, Its working fine and getting the value-pair but i can see the commands which are executed in the switch console. Please help how i can do so. As i never integrated Micosoft 2008 AD with FreeRADIUS i need a how-to may be a step-by-step which can help me in integrating the same. Do i need a DB like MySQL for accounting or AD LDAP DB will help in doing so? Thanks for all your help. Regards, /Neo
On 20 Jan 2013, at 07:31, pradyumna dash <neomatrixgem@gmail.com> wrote:
Hi Team,
Were a community.
I need a help, am new to RADIUS and i need the below to be configured.
I. FreeRADIUS integration with Microsoft AD
http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HOW... http://deployingradius.com/documents/configuration/active_directory.html
II. Cisco switches needs to be the client II. The accounting information should also contain the commands executed in the Switch as well, Example If a used called "test" login to the switch and exexuted a command "Show config" that should be captured in the accounting information.
Please read the Cisco documentation and add a howto here: http://wiki.freeradius.org/vendor/Cisco The above link might also contain some useful info about configuring Cisco switches for admin authentication.
What i have done till now is configured FreeRADIUS and created some local users and getting the switch to authenticated against the local user, Its working fine and getting the value-pair but i can see the commands which are executed in the switch console. Please help how i can do so.
As i never integrated Micosoft 2008 AD with FreeRADIUS i need a how-to may be a step-by-step which can help me in integrating the same.
See above.
Do i need a DB like MySQL for accounting or AD LDAP DB will help in doing so?
Yes, you'll need an SQL database for accounting. -Arran
Hi,
I. FreeRADIUS integration with Microsoft AD
http://deployingradius.com/documents/configuration/active_directory.html
II. Cisco switches needs to be the client
http://www.cisco.com/cisco/web/support/index.html find your switch model and the documents for it.
II. The accounting information should also contain the commands executed in the Switch as well, Example If a used called "test" login to the switch and exexuted a command "Show config" that should be captured in the accounting information.
Cisco switches. their RADIUS for such stuff is weak and usually non existant. use TACACS+
Do i need a DB like MySQL for accounting or AD LDAP DB will help in doing so?
I'd advise using SQL for accounting records but its not necessary. a plain flat file will do just as well in the beginning. alan
Hi, Thanks I have now configured the freeradius and the Cisco switch is now getting authenticated against the AD user but I can't see the commands executed in the switch by this user in the radius account log. Is it possible to see the command executed in accounting log ? Regards, /Neo Sent from my iPhone On 20-Jan-2013, at 5:57 PM, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
I. FreeRADIUS integration with Microsoft AD
http://deployingradius.com/documents/configuration/active_directory.html
II. Cisco switches needs to be the client
http://www.cisco.com/cisco/web/support/index.html
find your switch model and the documents for it.
II. The accounting information should also contain the commands executed in the Switch as well, Example If a used called "test" login to the switch and exexuted a command "Show config" that should be captured in the accounting information.
Cisco switches. their RADIUS for such stuff is weak and usually non existant. use TACACS+
Do i need a DB like MySQL for accounting or AD LDAP DB will help in doing so?
I'd advise using SQL for accounting records but its not necessary. a plain flat file will do just as well in the beginning.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
Thanks I have now configured the freeradius and the Cisco switch is now getting authenticated against the AD user but I can't see the commands executed in the switch by this user in the radius account log.
follow the cisco docs for configuring your device for RADIUS accounting.....and look up TACACS+ alan
Hi, Thanks for the suggestion. The below setup is now working for me. I. Users are getting authenticated from the AD server II. I have configured the switch to send the accounting logs to TACACS and its working But am not able to see the value-attribute pair which i have passed, I can login to the switch with the AD user account but am landing at the ">" prompt and the priv showing "1", Where as i have passed the priv level "15" , So not sure how to fix this. PFA the configuration files. Please help. Regards, /Neo On Wed, Jan 23, 2013 at 12:00 AM, <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
Thanks I have now configured the freeradius and the Cisco switch is now getting authenticated against the AD user but I can't see the commands executed in the switch by this user in the radius account log.
follow the cisco docs for configuring your device for RADIUS accounting.....and look up TACACS+
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi, you need whitspace before the service-type and cisco VSA lines after your auth line (they are reply items.....not check items) - if you run in debug mode (radiusd -X or freeradius -X on some distros) you can confirm from the output that the VSA/TLV are being sent to the client (switch). if they are, and you are stil being dumped on the basic prompt then you need to revisit the cisco docs and ensure that you have all the required AAA lines in place to allow admin/enable access after login (ie if FreeRADIUS is sending the right stuff, then its a NAS configuration issue) alan
Hi Alan, Thanks for your reply. Do you mean the below in the "users" file? cisco Auth-Type := LDAP Service-Type = Administrative-User, cisco-avpair = "shell:priv-lvl=15" Regards, /Neo On Thu, Jan 24, 2013 at 11:19 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
you need whitspace before the service-type and cisco VSA lines after your auth line (they are reply items.....not check items) - if you run in debug mode (radiusd -X or freeradius -X on some distros) you can confirm from the output that the VSA/TLV are being sent to the client (switch).
if they are, and you are stil being dumped on the basic prompt then you need to revisit the cisco docs and ensure that you have all the required AAA lines in place to allow admin/enable access after login (ie if FreeRADIUS is sending the right stuff, then its a NAS configuration issue)
alan
Hi,
Do you mean the below in the "users" file?
cisco Auth-Type := LDAP
Service-Type = Administrative-User, cisco-avpair = "shell:priv-lvl=15"
no. cisco Auth-Type := LDAP Service-Type = Administrative-User, cisco-avpair = "shell:priv-lvl=15" (see all the examples in the users file) alan
Hi, Am not able to see my authorization happening because I don't see the value-attr or reply message. Please help. Logs attached. rad_recv: Access-Request packet from host 192.168.0.2 port 39662, id=92, length=62 User-Name = "radiustest" User-Password = "password@123" NAS-IP-Address = 192.168.0.2 NAS-Port = 1812 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/192.168.0.2/auth-detail-20130128 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.0.2/auth-detail-20130128 [auth_log] expand: %t -> Mon Jan 28 10:12:16 2013 ++[auth_log] returns ok [ldap] performing user authorization for radiustest [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> radiustest [ldap] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=radiustest)) [ldap] expand: cn=users,dc=example,dc=com -> cn=users,dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=users,dc=example,dc=com, with filter (&(sAMAccountName=radiustest)) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = ldap [ldap] user radiustest authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "radiustest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ldap] performing user authorization for radiustest [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> radiustest [ldap] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=radiustest)) [ldap] expand: cn=users,dc=example,dc=com -> cn=users,dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=users,dc=example,dc=com, with filter (&(sAMAccountName=radiustest)) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user radiustest authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = ldap # Executing group from file /etc/raddb/sites-enabled/default +- entering group LDAP {...} [ldap] login attempt by "radiustest" with password "password@123" [ldap] user DN: CN=radiustest,CN=Users,DC=example,DC=com [ldap] (re)connect to 192.168.0.3:389, authentication 1 [ldap] bind as CN=radiustest,CN=Users,DC=example,DC=com/password@123 to 192.168.0.3:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user radiustest authenticated succesfully ++[ldap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 92 to 192.168.0.2 port 39662 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 92 with timestamp +88 Ready to process requests. Regards, /Neo Sent from my iPhone On 25-Jan-2013, at 3:32 AM, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
Do you mean the below in the "users" file?
cisco Auth-Type := LDAP
Service-Type = Administrative-User, cisco-avpair = "shell:priv-lvl=15"
no.
cisco Auth-Type := LDAP Service-Type = Administrative-User, cisco-avpair = "shell:priv-lvl=15"
(see all the examples in the users file)
alan
Hi,
Am not able to see my authorization happening because I don't see the value-attr or reply message. Please help. Logs attached.
please do not email me and the freeradius users mailing list. much like the other Alan, I am already on that list and so choose to read/reply. I'm not your contracted support.
rad_recv: Access-Request packet from host 192.168.0.2 port 39662, id=92, length=62
User-Name = "radiustest"
okay. the reply clearly only showed an Access-Accept packet with no details....but your users file that you gave us had 'cisco' as the user-name - this has 'radiustest' as the user-name. make sure the 2 are the same and you have the right configuration. alan
Hi, Am still struggling to get the accounting details, am not getting any value-attr pair or Reply message, However authentication works fine. Regards, /Neo On Mon, Jan 28, 2013 at 3:26 PM, <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
Am not able to see my authorization happening because I don't see the value-attr or reply message. Please help. Logs attached.
please do not email me and the freeradius users mailing list. much like the other Alan, I am already on that list and so choose to read/reply. I'm not your contracted support.
rad_recv: Access-Request packet from host 192.168.0.2 port 39662, id=92, length=62
User-Name = "radiustest"
okay. the reply clearly only showed an Access-Accept packet with no details....but your users file that you gave us had 'cisco' as the user-name - this has 'radiustest' as the user-name.
make sure the 2 are the same and you have the right configuration.
alan
pradyumna dash wrote:
Am still struggling to get the accounting details, am not getting any value-attr pair or Reply message, However authentication works fine.
I have no idea what that means. How about running the server in debugging mode, as suggested in the FAQ, "man" page, web pages, and daily on this list? Alan DeKok.
pradyumna dash wrote:
But am not able to see the value-attribute pair which i have passed, I can login to the switch with the AD user account but am landing at the ">" prompt and the priv showing "1", Where as i have passed the priv level "15" , So not sure how to fix this.
PFA the configuration files.
No. We don't care about the configuration. The FAQ, "man page", and web pages says to post the output of "radiusd -X". It also helps for you to *read* the output of "radiusd -X". A little bit of thought goes a long ways. Alan DeKok.
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Arran Cudbard-Bell -
Pradyumna -
pradyumna dash