Freeradius Samba4 group restriction
Hi All, I am seeking some help regarding group access. I've have built a system by using freeradius, samba4 (AD) to secure our Wireless network. The client authentication works perfectly fine, but I'd like to deny access to some specific groups. I can deny access to users but not groups. Could someone point me to the right direction? Regards, David
On Mon, Feb 06, 2017 at 02:17:52PM +0100, Dávid Erős wrote:
I am seeking some help regarding group access. I've have built a system by using freeradius, samba4 (AD) to secure our Wireless network. The client authentication works perfectly fine, but I'd like to deny access to some specific groups. I can deny access to users but not groups. Could someone point me to the right direction?
Have a look at group support in rlm_ldap. http://wiki.freeradius.org/modules/Rlm_ldap#group-support Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi Matthew, Thank you for the link ,but I'd like to avoid using Ldap. Is there another way to get this done by winbind and rlm_unix? Regards, David 2017-02-06 14:31 GMT+01:00 Matthew Newton <mcn4@leicester.ac.uk>:
On Mon, Feb 06, 2017 at 02:17:52PM +0100, Dávid Erős wrote:
I am seeking some help regarding group access. I've have built a system by using freeradius, samba4 (AD) to secure our Wireless network. The client authentication works perfectly fine, but I'd like to deny access to some specific groups. I can deny access to users but not groups. Could someone point me to the right direction?
Have a look at group support in rlm_ldap.
http://wiki.freeradius.org/modules/Rlm_ldap#group-support
Matthew
-- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Tue, Feb 07, 2017 at 08:50:02AM +0100, Dávid Erős wrote:
Thank you for the link ,but I'd like to avoid using Ldap. Is there another way to get this done by winbind and rlm_unix?
rlm_ldap is still the best way at present. There is new experimental code in the unsupported v3.1.x branch which can check groups directly with winbind. If you want to give it a spin, look at rlm_winbind. Make sure you only check groups in post-auth after a successful authentication. https://github.com/FreeRADIUS/freeradius-server/blob/v3.1.x/raddb/mods-avail... But you're pretty much on your own if something breaks with 3.1.x. I guess you could try using rlm_unix and Samba groups or something like that, but configuring ldap would be a much cleaner solution. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
On 07/02/2017 11:19, Matthew Newton wrote:
On Tue, Feb 07, 2017 at 08:50:02AM +0100, Dávid Erős wrote:
Thank you for the link ,but I'd like to avoid using Ldap. Is there another way to get this done by winbind and rlm_unix? rlm_ldap is still the best way at present.
There is new experimental code in the unsupported v3.1.x branch which can check groups directly with winbind. If you want to give it a spin, look at rlm_winbind. Make sure you only check groups in post-auth after a successful authentication. Aside: if you're doing any sort of policy checking in post-auth, what's the official / supported way to change an Access-Accept into an Access-Reject ?
Is it simply to invoke 'reject' from the 'always' module? Thanks, Brian.
On 7 Feb 2017, at 14:02, Brian Candler <B.Candler@pobox.com> wrote:
On 07/02/2017 11:19, Matthew Newton wrote:
On Tue, Feb 07, 2017 at 08:50:02AM +0100, Dávid Erős wrote:
Thank you for the link ,but I'd like to avoid using Ldap. Is there another way to get this done by winbind and rlm_unix? rlm_ldap is still the best way at present.
There is new experimental code in the unsupported v3.1.x branch which can check groups directly with winbind. If you want to give it a spin, look at rlm_winbind. Make sure you only check groups in post-auth after a successful authentication. Aside: if you're doing any sort of policy checking in post-auth, what's the official / supported way to change an Access-Accept into an Access-Reject ?
Is it simply to invoke 'reject' from the 'always' module?
That really confuses supplicants in the case of PEAP. It’ll work in that dot1x auth will fail, but it’s not a great way to do it, but it’s probably the best you can do for v3.0.x. In v4.0.x the plan is to expose the MSCHAPv2 states as sections within an MSCHAPv2 virtual server. That means you can make policy decisions during MSCHAPv2 processing, and send failures all the way up through MSCHAPv2->PEAP->EAP->RADIUS stack. -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Hi,
Thank you for the link ,but I'd like to avoid using Ldap. Is there another way to get this done by winbind and rlm_unix?
LDAP is the best/scalable/robust way. however, with 3.1.x you can check group membership with the winbind module.... and you can always use the unix module - just read the docs for how to use it/requirements alan
Hi, Thank you guys for the hint. I finally got it working by using the ldap module. Regards, David 2017-02-07 14:03 GMT+01:00 <A.L.M.Buxey@lboro.ac.uk>:
Hi,
Thank you for the link ,but I'd like to avoid using Ldap. Is there another way to get this done by winbind and rlm_unix?
LDAP is the best/scalable/robust way. however, with 3.1.x you can check group membership with the winbind module.... and you can always use the unix module - just read the docs for how to use it/requirements
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Arran Cudbard-Bell -
Brian Candler -
Dávid Erős -
Matthew Newton