Hello people, I’m newcomer here as well as on freeradius. I have a environment with Radius integrated with Active directory so I can login on Cisco’s Switches with AD account. All it’s working but I should like give privilege 15 for users that login. I have done the follow lines on “user” file user1 Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15", Fall-Through = Yes When user1 do login on cisco switch he need type “enable” more local password for enable instead your password from Active Directory I should like when user “user1” login on Cisco Switch and type enable he earn privileges 15 directly without any password or your password from AD instead local enable password. What I have to do for reach this ? I’m using freeradius 3.0 Thanks.
On Feb 1, 2019, at 10:50 AM, Maicon Luis <maiconlp@hotmail.com> wrote:
I’m newcomer here as well as on freeradius.
Welcome! It's not as bad as sometimes rumoured. :)
I have a environment with Radius integrated with Active directory so I can login on Cisco’s Switches with AD account. All it’s working but I should like give privilege 15 for users that login.
I have done the follow lines on “user” file
user1 Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15", Fall-Through = Yes
When user1 do login on cisco switch he need type “enable” more local password for enable instead your password from Active Directory
I should like when user “user1” login on Cisco Switch and type enable he earn privileges 15 directly without any password or your password from AD instead local enable password.
That's a configuration for the switch, unless I'm mistaken. i.e. the Cisco documentation should describe how to do this. There might be some RADIUS involved, but largely it means having the RADIUS server return the "right" atrributes. And what are the "right" attributes? I don't know. Read the Cisco docs to see what their product needs. Alan DeKok.
On Fri, 2019-02-01 at 12:52 -0500, Alan DeKok wrote:
On Feb 1, 2019, at 10:50 AM, Maicon Luis <maiconlp@hotmail.com> wrote:
I have done the follow lines on “user” file
user1 Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15", Fall-Through = Yes
And what are the "right" attributes? I don't know. Read the Cisco docs to see what their product needs.
I believe they are the right attributes - at least, I've seen it working with those before. So it's either that the RADIUS server isn't returning them (run in debug mode `radiusd -X` to see), or that there is additional config needed on the switch. -- Matthew
Maicon, There is additional config you need on the switch. If you're running IOS or IOS-XE (e.g., on a Catalyst series switch), you need to add "aaa new-model" and "aaa authorization exec" to your config. The latter must include as parameters "group <RADNAME>", where "<RADNAME>" is either "radius" (to use the sole or default set of configured RADIUS servers), or is the name of a group of RADIUS servers defined by "aaa group server radius <RADNAME>". As you'll see in docs, "aaa authorization exec" can have multiple ordered authorization sources (e.g., local-then-RADIUS), just like when you defined "aaa authentication login". On 2/1/2019 12:28 PM, Matthew Newton wrote:
On Fri, 2019-02-01 at 12:52 -0500, Alan DeKok wrote:
On Feb 1, 2019, at 10:50 AM, Maicon Luis <maiconlp@hotmail.com> wrote:
I have done the follow lines on “user” file
user1 Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15", Fall-Through = Yes
And what are the "right" attributes? I don't know. Read the Cisco docs to see what their product needs.
I believe they are the right attributes - at least, I've seen it working with those before.
So it's either that the RADIUS server isn't returning them (run in debug mode `radiusd -X` to see), or that there is additional config needed on the switch.
-- Douglas C. Stephens | Network Systems Analyst Enterprise Information Services | Phone: (515) 294-6102 Ames Laboratory, US DOE | Email: stephend@ameslab.gov
participants (4)
-
Alan DeKok -
Douglas C. Stephens -
Maicon Luis -
Matthew Newton