how to organize groups of users getting access to groups of servers
I want to use freeradius to authenticate different groups of users (from LDAP) to sets of network devices, potentially with different access levels, but have a bit hard time understanding how this is supposed to be configured. Would be nice with some advice.. What I have so far is: # Give ldap group "firewall" super-user privilege on juniper firewalls: DEFAULT Ldap-Group == "cn=firewall,cn=groups,cn=accounts,dc=example,dc=com" Auth-Type := LDAP Juniper-Local-User-Name := "super-users", # Give ldap group "netadmin" "enable" access on cisco routers: DEFAULT Ldap-Group == "cn=netadmin,cn=groups,cn=accounts,dc=example,dc=com" Auth-Type := LDAP cisco-avpair = "shell:priv-lvl=15" But this doesn't work for users that are member of both groups, so I need to say that the first rule is limited to a set of juniper devices, and the second is limited to a set of cisco devices. What's the strategy we should use for expressing this? Is it possible without having to specify one rule for each NAS-IP-Address? I.e. being able to do some kind og grouping of clients to match on would be very helpful.. -jf
Jan-Frode Myklebust wrote:
I want to use freeradius to authenticate different groups of users (from LDAP) to sets of network devices, potentially with different access levels, but have a bit hard time understanding how this is supposed to be configured. Would be nice with some advice..
Write out the rules in plain english. Then, translate them into "unlang". The translation is fairly direct.
What I have so far is:
# Give ldap group "firewall" super-user privilege on juniper firewalls: DEFAULT Ldap-Group == "cn=firewall,cn=groups,cn=accounts,dc=example,dc=com" Auth-Type := LDAP Juniper-Local-User-Name := "super-users",
# Give ldap group "netadmin" "enable" access on cisco routers: DEFAULT Ldap-Group == "cn=netadmin,cn=groups,cn=accounts,dc=example,dc=com" Auth-Type := LDAP cisco-avpair = "shell:priv-lvl=15"
But this doesn't work for users that are member of both groups, so I need to say that the first rule is limited to a set of juniper devices, and the second is limited to a set of cisco devices.
Yes, the two rules don't check which client device is being used. They also don't check if the user is *asking* for administrator privilege.
What's the strategy we should use for expressing this? Is it possible without having to specify one rule for each NAS-IP-Address? I.e. being able to do some kind og grouping of clients to match on would be very helpful..
Add a 'type' for each client: client foo { ipaddr = x secret = type ... type = juniper } Then use "unlang": if ("%{client:type}" == "juniper") { // check if the user is ASKING for admin access if (LDAP-Group != cn=firewall,cn=groups,cn=accounts,dc=example,dc=com) { reject } update control { Auth-Type := LDAP } update reply { Juniper-Local-User-Name := "super-users" } } And you probably don't want to force "Auth-Type := LDAP". Just list "ldap" in the "authorize" section. Alan DeKok.
On Tue, Mar 25, 2014 at 03:44:37PM -0400, Alan DeKok wrote:
Add a 'type' for each client:
client foo { ipaddr = x secret = type ... type = juniper }
Is this a variable that you just created here for this purpose, or a standard attribute? I.e. can we add random new attributes here? We'd probably like to match on more than "type"... At least also on "branch", to give people on branch offices management of their own devices. BTW: we're on v2.1.12-4.el6_3 (RHEL6-latest), and the manpage for clients.conf doesn't say anything about a "type" or allowing to add new variables..
Then use "unlang":
Thanks! That looks very powerfull! -jf
Jan-Frode Myklebust wrote:
Is this a variable that you just created here for this purpose, or a standard attribute? I.e. can we add random new attributes here?
You can out random things in the config file. The server is flexible that way. So long as it parses, it will load, and be usable. e.g. put this into the bottom of radiusd.conf, and it will work: house { window = yes door = no electricity = paid rent = 1500 } The server won't care. It will still work.
We'd probably like to match on more than "type"... At least also on "branch", to give people on branch offices management of their own devices.
Yup.
BTW: we're on v2.1.12-4.el6_3 (RHEL6-latest), and the manpage for clients.conf doesn't say anything about a "type" or allowing to add new variables..
It doesn't say that, because it's a property of the config files, not the client section. There are some corners of the server yet to be documented.
Then use "unlang":
Thanks! That looks very powerfull!
It makes all of the difference in the world. It's simple enough to be easily understandable, and complex enough to do a lot of useful work. Alan DeKok.
participants (2)
-
Alan DeKok -
Jan-Frode Myklebust