authenticate cisco nexus 5000 with freeradius
Peace, according to https://community.cisco.com/t5/security-knowledge-base/nexus-integration-for... the freeradius configuration is as such: DEFAULT Group == cisco-rw, Auth-Type = System Service-Type = NAS-Prompt-User, cisco-avpair := "shell:roles*\"network-admin vdc-admin\"", but it does not mention what section of freeradius to modify, i tried adding all the information to the user, but then free radius wouldn't restart. which means Default group needs to be added to a different section. any help?
On 27.02.24 10:37, Majed Zouhairy wrote:
Peace, according to https://community.cisco.com/t5/security-knowledge-base/nexus-integration-for...
the freeradius configuration is as such:
DEFAULT Group == cisco-rw, Auth-Type = System
Service-Type = NAS-Prompt-User,
cisco-avpair := "shell:roles*\"network-admin vdc-admin\"",
but it does not mention what section of freeradius to modify, i tried adding all the information to the user, but then free radius wouldn't restart. which means Default group needs to be added to a different section.
Auth-Type = System is quite old-fashioned. Please update your freeradius / configuration.
On Feb 27, 2024, at 4:37 AM, Majed Zouhairy <m_zouhairy@ckta.by> wrote:
Peace, according to https://community.cisco.com/t5/security-knowledge-base/nexus-integration-for...
That's from 2013. And assumes a particular set of requirements.
the freeradius configuration is as such:
It's not good to copy random things from the net and hope that they work. It's better to read the documentation and understand how it works.
DEFAULT Group == cisco-rw, Auth-Type = System
Service-Type = NAS-Prompt-User,
cisco-avpair := "shell:roles*\"network-admin vdc-admin\"",
but it does not mention what section of freeradius to modify,
If you understand how the server works (which is the recommended approach), then the place is obvious.
i tried adding all the information to the user, but then free radius wouldn't restart. which means Default group needs to be added to a different section.
No. The server gives a very clear error. If you read the error, you'll see what's wrong. You should read this: http://wiki.freeradius.org/list-help It explains what information we need to help you. You should also try explaining what you want to do. i.e. describe your requirements, and maybe we can help you meet the requirements. That's a much better approach than saying "I followed a 10 year-old blog post and it didn't work". Alan DeKok.
On 2/27/24 16:11, Alan DeKok wrote:
On Feb 27, 2024, at 4:37 AM, Majed Zouhairy <m_zouhairy@ckta.by> wrote:
Peace, according to https://community.cisco.com/t5/security-knowledge-base/nexus-integration-for...
That's from 2013. And assumes a particular set of requirements.
the freeradius configuration is as such:
It's not good to copy random things from the net and hope that they work.
It's better to read the documentation and understand how it works.
DEFAULT Group == cisco-rw, Auth-Type = System
Service-Type = NAS-Prompt-User,
cisco-avpair := "shell:roles*\"network-admin vdc-admin\"",
but it does not mention what section of freeradius to modify,
If you understand how the server works (which is the recommended approach), then the place is obvious.
i tried adding all the information to the user, but then free radius wouldn't restart. which means Default group needs to be added to a different section.
No.
The server gives a very clear error. If you read the error, you'll see what's wrong.
You should read this: http://wiki.freeradius.org/list-help
It explains what information we need to help you.
You should also try explaining what you want to do. i.e. describe your requirements, and maybe we can help you meet the requirements. That's a much better approach than saying "I followed a 10 year-old blog post and it didn't work".
Alan DeKok.
i'm trying to authenticate an old 5k nexus cisco switch with freeradius, but when i enable aaa authentication, i get the error: command not permitted for the current role. it is obvious that an av pair is needed with network operator role for aaa to work, now the question is what is needed to be added to freeradius so that the avpair is activated?
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Feb 29, 2024, at 4:29 AM, Majed Zouhairy <m_zouhairy@ckta.by> wrote:
i'm trying to authenticate an old 5k nexus cisco switch with freeradius, but when i enable aaa authentication, i get the error: command not permitted for the current role. it is obvious that an av pair is needed with network operator role for aaa to work, now the question is what is needed to be added to freeradius so that the avpair is activated?
Ask Cisco. Their documentation should sat which attributes are needed. We don't document (or even know) every possible attribute which can be configured on every possible vendor device. Alan DeKok.
On Thu, 29 Feb 2024, Majed Zouhairy wrote:
[snip..]
i'm trying to authenticate an old 5k nexus cisco switch with freeradius, but when i enable aaa authentication, i get the error: command not permitted for the current role. it is obvious that an av pair is needed with network operator role for aaa to work, now the question is what is needed to be added to freeradius so that the avpair is activated?
-
You need to add a Cisco-AVPair attribute with the correct value to your 'Access-Accept' response. This can be done by augmenting the correct record for your admin-people in your 'authorize' config file. It could look something like: # admin Cleartext-Password := "*REDACTED*" Service-Type = Administrative-User, filter-id = "super user", Callback-Number = "admin", Cisco-AVPair = "shell:priv-lvl=15", TrippLite-Authorization = "default=rw", Reply-Message := "Hello, %{User-Name}" # Note the actual value of that Cisco-AVPair attribute will need to be determined by you to meet your needs. Look at the Cisco documents to see what they mean. In that example there are other attributes for other types of equipment (EG: TrippLite-Authorization) omit or adjust as appropriate for your needs. -- Dave Funk University of Iowa <dbfunk (at) engineering.uiowa.edu> College of Engineering 319/335-5751 FAX: 319/384-0549 1256 Seamans Center, 103 S Capitol St. Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527 #include <std_disclaimer.h> Better is not better, 'standard' is better. B{
participants (4)
-
Alan DeKok -
Dave Funk -
Majed Zouhairy -
Michael Schwartzkopff