Hello, I apologize if these questions have already been answered. I have scoured the internet for help, but have been unable to find what I'm looking for. Keep in mind this was the first time I have ever used linux so at the beginning of this project I was beyond newb. I am setting up a freeRADIUS (2.1.10) server for my network. I have everything working how I want it to except for some of the permission settings. For example, when users log in to Motorola radios in my network via freeRADIUS they only receive read-only permissions. Or when a Cisco user logs in I would like for them to receive automatic #privilege level 15. I need for users to receive admin privileges. How do I accomplish this? NOTE: I'm authenticating against active directory. So where can I configure things like "cisco-avpair = shell:priv-lvl=15, or Motorola-WIBB-Auth-Role = system-admin-role?" I understand how to configure permissions when you have individual users configured in users.conf. file. How do you configure permissions when you don't have any local users configured, but are using Active Directory? Right now I use only one Active Directory group "Radius-Users" for authentication. If a user is part of the Radius-Users group on the AD server, then they get access. This is fine for now, but in the future I would like to set up more granular access control. I have seen a lot of talk about LDAP groups, but have not been able to find decent information on it. Ideally I would like for there to be several different user groups set up with different permissions for each. How do you accomplish this with freeRADIUS + Active Directory? Any help would be much appreciated. Thank you, TBrady
Tyler Brady wrote:
I am setting up a freeRADIUS (2.1.10) server for my network. I have everything working how I want it to except for some of the permission settings. For example, when users log in to Motorola radios in my network via freeRADIUS they only receive read-only permissions. Or when a Cisco user logs in I would like for them to receive automatic #privilege level 15. I need for users to receive admin privileges. How do I accomplish this?
Use LDAP groups.
NOTE: I’m authenticating against active directory. So where can I configure things like “/cisco/-/avpair/ = /shell/:/priv/-/lvl=15, or Motorola-WIBB-Auth-Role = system-admin-role?” I// understand how to configure permissions when you have individual users configured in users.conf. file. How do you configure permissions when you don’t have any local users configured, but are using Active Directory?/
Groups.
/Right now I use only one Active Directory group “//Radius-Users//” for authentication. If a user is part of the //Radius-Users// group on the AD server, then they get access. This is fine for now, but in the future I would like to set up more granular access control. I have seen a lot of talk about LDAP groups, but have not been able to find decent information on it. Ideally I would like for there to be several different user groups set up with different permissions for each. How do you accomplish this with freeRADIUS + Active Directory?/
Set up groups in LDAP. See the LDAP / AD documentation. Then, in FreeRADIUS, check them: #-- users file DEFAULT LDAP-Group == "foo", ... ... #--- Alan DeKok.
G'day all 2013/1/5 Alan DeKok <aland@deployingradius.com>: [snip]
Set up groups in LDAP. See the LDAP / AD documentation.
Then, in FreeRADIUS, check them:
#-- users file DEFAULT LDAP-Group == "foo", ... ...
#---
(protest if this may sound like hijacking this thread...) As short question since Tyler was asking for AD as backend - which I have read (so far) can't use the LDAP module since AD stores ntlm hashes - at least not for authentication. But then for LDAP groups how is that supposed to be done when using Samba/Winbind/ntlm_auth? Can I use LDAP groups for authorization (interestingly something I've not really found covered online or in FreeRADIUS books I've had at hand). Best regards Mathieu
Hi,
(protest if this may sound like hijacking this thread...) As short question since Tyler was asking for AD as backend - which I have read (so far) can't use the LDAP module since AD stores ntlm hashes - at least not for authentication.
huh? this wasnt about authentication, it was about authorization - ie passing back details about what a user can do on some kit - that works fine 100% fine with LDAP and AD
But then for LDAP groups how is that supposed to be done when using Samba/Winbind/ntlm_auth?
?? it isnt. ntlm_auth/samba/winbindd is purely for authentication - for authorization you use the LDAP module talking to your AD and use the AD as a DB oracle not an authentication source
Can I use LDAP groups for authorization (interestingly something I've not really found covered online or in FreeRADIUS books I've had at hand).
its all covered in the books/docs/wiki alan
G'day Alan(s) 2013/1/5 <A.L.M.Buxey@lboro.ac.uk>: <snip>
huh? this wasnt about authentication, it was about authorization - ie passing back details about what a user can do on some kit - that works fine 100% fine with LDAP and AD
Thank you both for pointing in the correct directions by pointing me back at authentication != authorization thing. I'm messing around with configurations files - yes I agree to be a beginner even after some time wrestling with FreeRADIUS now. ;-) The thing I did here in mytest env wasn't actually doing authorization, but "kind of" authentication restriction, via ntlm_auth's "--require-membership-of" parameter during auhtentication phase. Thanks you guys! -- Mathieu
Can someone give more details on setting up LDAP groups? So far I have attempted to modify the users file and the ldap module. I can't seem to get the ldap module configured properly, but I'm sure that's just one of many issues. ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "ldap.your.domain" #identity = "cn=admin,o=My Org,c=UA" #password = mypass basedn = "o=My Org,c=UA" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" #base_filter = "(objectclass=radiusprofile)" cn = username (is this correct) o= domain (is this correct) c= ? (what does this field mean) Thank you, T. Brady
On 01/09/2013 02:00 PM, Tyler Brady wrote:
Can someone give more details on setting up LDAP groups? So far I have attempted to modify the users file and the ldap module. I can't seem to get the ldap module configured properly, but I'm sure that's just one of many issues.
ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "ldap.your.domain" #identity = "cn=admin,o=My Org,c=UA" #password = mypass basedn = "o=My Org,c=UA" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" #base_filter = "(objectclass=radiusprofile)"
cn = username (is this correct) o= domain (is this correct) c= ? (what does this field mean)
identity is the bind dn, it's an ldap concept, refer to ldap literature to learn what a bind dn is. The bind dn you should be using is specific to your deployment, ask whoever is managing your ldap server what to use. Remember this represents a server-to-server binding, not a user-to-server binding, in other words the radius server is binding to your ldap server to perform lookup's related to users and groups thus the identity you bind as will need permission to view that portion of the ldap tree. -- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
Hi Tyler Since I'm in a similar situation with AD but still learning, just general experience with other Applications from the *nix world authenticating against AD: 2013/1/9 John Dennis <jdennis@redhat.com>:
On 01/09/2013 02:00 PM, Tyler Brady wrote:
Can someone give more details on setting up LDAP groups? So far I have attempted to modify the users file and the ldap module. I can't seem to get the ldap module configured properly, but I'm sure that's just one of many issues.
ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "ldap.your.domain" #identity = "cn=admin,o=My Org,c=UA" #password = mypass basedn = "o=My Org,c=UA" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" #base_filter = "(objectclass=radiusprofile)"
cn = username (is this correct) o= domain (is this correct) c= ? (what does this field mean)
Your AD admin (you?) needs to create a basic user account, no domain admin needed - who can read the parts of your AD/LDAP tree as John said. (We maintain a couple of srv-* accounts here to quickly distinguis between real user accounts) You'll need the value of the distinguishedName attribute on AD, your Admin can give you this value, but it's hidden by default in the GUI.* For "server=" (don't know of recommended for FR too): You could point to your.domainname, as this is a DNS record maintained by your AD-integrated nameservers who will point to all addresses of your current DCs. BaseDN - yeah, look up a little what it is, it's the base your FR will start looking up inside the LDAP tree. Regards Mathieu * http://www.sharepointboost.com/blog/how-to-find-attributes-of-objects-in-act...
I think my bind is working fine now, but my basedn = "o=My Org,c=UA" field is still wrong. I'm still not sure of the syntax. Any suggestions? [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to office.company.stc:389, authentication 0 [ldap] bind as cn=user name,ou=Phoenix_Users,dc=company,dc=stc/Sup3rS3cret to office.company.stc:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=Phoenix_Users,dc=company,dc=stc, with filter (uid=tbrady) [ldap] object not found rlm_ldap::ldap_groupcmp: search failed [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop [ldap] performing user authorization for tbrady [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> tbrady [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=tbrady) [ldap] expand: ou=Phoenix_Users,dc=company,dc=stc -> ou=Phoenix_Users,dc=company,dc=stc [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Phoenix_Users,dc=company,dc=stc, with filter (uid=tbrady) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound T. Brady -----Original Message----- From: freeradius-users-bounces+tbrady=stc-comm.com@lists.freeradius.org [mailto:freeradius-users-bounces+tbrady=stc-comm.com@lists.freeradius.org] On Behalf Of Mathieu Simon Sent: Wednesday, January 09, 2013 12:53 PM To: FreeRadius users mailing list Subject: Re: AD Authentication Permissions Hi Tyler Since I'm in a similar situation with AD but still learning, just general experience with other Applications from the *nix world authenticating against AD: Your AD admin (you?) needs to create a basic user account, no domain admin needed - who can read the parts of your AD/LDAP tree as John said. (We maintain a couple of srv-* accounts here to quickly distinguis between real user accounts) You'll need the value of the distinguishedName attribute on AD, your Admin can give you this value, but it's hidden by default in the GUI.* For "server=" (don't know of recommended for FR too): You could point to your.domainname, as this is a DNS record maintained by your AD-integrated nameservers who will point to all addresses of your current DCs. BaseDN - yeah, look up a little what it is, it's the base your FR will start looking up inside the LDAP tree. Regards Mathieu
On 01/09/2013 05:10 PM, Tyler Brady wrote:
I think my bind is working fine now, but my basedn = "o=My Org,c=UA" field is still wrong. I'm still not sure of the syntax. Any suggestions?
I don't see a basedn of "o=My Org,c=UA" anywhere, however I do see a basedn of "ou=Phoenix_Users,dc=company,dc=stc" Hint, rlm_ldap is simply doing what the ldapsearch command does. Try using ldapsearch giving it the parameters you expect to be correct, iterate until the search succeeds, then use those same parameters in your radius ldap config. BTW, your ldap password "Sup3rS3cret" is no longer super secret ;-)
[ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to office.company.stc:389, authentication 0 [ldap] bind as cn=user name,ou=Phoenix_Users,dc=company,dc=stc/Sup3rS3cret to office.company.stc:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=Phoenix_Users,dc=company,dc=stc, with filter (uid=tbrady) [ldap] object not found rlm_ldap::ldap_groupcmp: search failed [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop [ldap] performing user authorization for tbrady [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> tbrady [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=tbrady) [ldap] expand: ou=Phoenix_Users,dc=company,dc=stc -> ou=Phoenix_Users,dc=company,dc=stc [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Phoenix_Users,dc=company,dc=stc, with filter (uid=tbrady) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound
-- John Dennis <jdennis@redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/
On Wed 1/9/2013 4:31 PM, John Dennis wrote:
I think my bind is working fine now, but my basedn = "o=My Org,c=UA" field is still wrong. I'm still not sure of the syntax. Any suggestions?
I don't see a basedn of "o=My Org,c=UA" anywhere, however I do see a basedn of "ou=Phoenix_Users,dc=company,dc=stc" Hint, rlm_ldap is simply doing what the ldapsearch command does. Try using ldapsearch giving it the parameters you expect to be correct, iterate until the search succeeds, then use those same parameters in your radius ldap config. BTW, your ldap password "Sup3rS3cret" is no longer super secret ;-) Thank you for the hints. I think I'm almost there... I'm testing this with a cisco switch. Using the config in the users file shown below, I receive the message "Welcome Message," but not the level 15 privileges. Users: DEFAULT = LDAP-Group == Radius-Users" Reply-Message = "Welcome Message", Cisco-AVPair = "shell:priv-lvl=15" Do I have to add cisco AVpair to ldap.attrmap or modify the dictionary file? If so, what is the correct syntax for adding it? Thanks again for all of the help.
Mathieu Simon wrote:
As short question since Tyler was asking for AD as backend - which I have read (so far) can't use the LDAP module since AD stores ntlm hashes - at least not for authentication.
You can't use AD as an LDAP module for *authentication*.
But then for LDAP groups how is that supposed to be done when using Samba/Winbind/ntlm_auth?
You configure AD as an LDAP server. And *don't* use it for authentication.
Can I use LDAP groups for authorization (interestingly something I've not really found covered online or in FreeRADIUS books I've had at hand).
Yes. Alan DeKok.
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
John Dennis -
Mathieu Simon -
Tyler Brady