Can't figure out Group Authentication
First, I'd like to thank Alan for his beyond countless hours of dedication to all the blogs, forum posting, and general support within the community. Your write-ups are thorough and well thought out. I wish more people were like you. I'm pretty new to RADIUS and as consequently, Linux in general. So I might ask questions that seem noobish or lame, but it doesn't mean I'm not willing to learn, research etc. Just bare with me. Now, the problem is this. Following Alan DeKok's guide at http://deployingradius.com/documents/configuration/active_directory.html, I was able to get FreeRADIUS 2.X running on CentOS 6.2 with pretty minimal effort. There were a few things I had to go elsewhere to figure out, but I managed. I have FreeRADIUS setup and authenticating using NTLM_AUTH. I was able to join my AD 2008 R2 Domain, I can list users, groups etc.. This RADIUS server will be for authenticating users on all of our Cisco devices, as well as remote access VPN users. So the problem is this. It's authenticating...a little too well. I've added the following entry into "/etc/raddb/clients.conf" to allow AAA on one of my cisco routers. ************************************* client 10.10.0.5 { secret = REALSECRETOMMITTED shortname = Cisco-2911-VPCRTR nastype = cisco } ************************************* Now, I then setup my Cisco router accordingly, and then did an SSH test to it using my AD Account. Voila! It worked great. However, so did every other "Domain User" account in the environment. This goes back to me being so new to RADIUS and Linux where I don't feel like I'm fully grasping all of the directives within the configuration files, and exactly how they all tie together. I'm getting there, but just not fast enough. So, how do I lock down the SSH Authentication to an Active Directory Group of users, or individual users? Remember, go easy on me. I'll provide whatever you need to help. I'm assuming you will ask for my RADIUSD -X output, so I've attached that as well. NOTE: One thing I don't understand is how in Alan DeKok's write up from the link above, he says don't use the "DEFAULT Auth-Type = ntlm_auth" in the "/etc/raddb/users" file, but yet that's one of the final steps to test in the write-up. Maybe it's because I am so new, but I've been through that document probably 30 times line by line, and yet every time I remove that entry, it breaks the Authentication. BEGIN RADIUSD -X DEBUG OUTPUT ************************************************************************************************** ************************************************************************************************** ************************************************************************************************** FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Jul 19 2011 at 10:21:08 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 172.16.1.1 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-4507-1" nastype = "cisco" } client 172.16.1.3 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-4507-2" nastype = "cisco" } client 172.16.1.2 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-ASA-5520-01" nastype = "cisco" } client 10.10.0.5 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-2911-VPCRTR" nastype = "cisco" } client 172.16.1.10 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-ASA-5510-GDM" nastype = "cisco" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Instantiating module "ntlm_auth" from file /etc/raddb/modules/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYREALDOMAIN-OMMITTED --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ************************************************************************************************** ************************************************************************************************** ************************************************************************************************** END RADIUSD -X DEBUG OUTPUT Jim C. Julson Sr. Network & Systems Administrator C 208.908.1476 jjulson@marketron.com<mailto:jjulson@marketron.com> [www.marketron.com]<http://www.marketron.com> [Learn more about Network Connect]<http://www.marketron.com/network-connect.php?email> The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.
I do it like this, in users file: DEFAULT Ldap-Group == "wifiusers" DEFAULT Auth-Type := Reject Anyone in wifiusers AD security group gets in, all others are rejected. Nolan From: freeradius-users-bounces+nking=mnwd.com@lists.freeradius.org [mailto:freeradius-users-bounces+nking=mnwd.com@lists.freeradius.org] On Behalf Of Julson, Jim Sent: Friday, June 22, 2012 8:32 AM To: freeradius-users@lists.freeradius.org Subject: Can't figure out Group Authentication First, I'd like to thank Alan for his beyond countless hours of dedication to all the blogs, forum posting, and general support within the community. Your write-ups are thorough and well thought out. I wish more people were like you. I'm pretty new to RADIUS and as consequently, Linux in general. So I might ask questions that seem noobish or lame, but it doesn't mean I'm not willing to learn, research etc. Just bare with me. Now, the problem is this. Following Alan DeKok's guide at http://deployingradius.com/documents/configuration/active_directory.html, I was able to get FreeRADIUS 2.X running on CentOS 6.2 with pretty minimal effort. There were a few things I had to go elsewhere to figure out, but I managed. I have FreeRADIUS setup and authenticating using NTLM_AUTH. I was able to join my AD 2008 R2 Domain, I can list users, groups etc.. This RADIUS server will be for authenticating users on all of our Cisco devices, as well as remote access VPN users. So the problem is this. It's authenticating...a little too well. I've added the following entry into "/etc/raddb/clients.conf" to allow AAA on one of my cisco routers. ************************************* client 10.10.0.5 { secret = REALSECRETOMMITTED shortname = Cisco-2911-VPCRTR nastype = cisco } ************************************* Now, I then setup my Cisco router accordingly, and then did an SSH test to it using my AD Account. Voila! It worked great. However, so did every other "Domain User" account in the environment. This goes back to me being so new to RADIUS and Linux where I don't feel like I'm fully grasping all of the directives within the configuration files, and exactly how they all tie together. I'm getting there, but just not fast enough. So, how do I lock down the SSH Authentication to an Active Directory Group of users, or individual users? Remember, go easy on me. I'll provide whatever you need to help. I'm assuming you will ask for my RADIUSD -X output, so I've attached that as well. NOTE: One thing I don't understand is how in Alan DeKok's write up from the link above, he says don't use the "DEFAULT Auth-Type = ntlm_auth" in the "/etc/raddb/users" file, but yet that's one of the final steps to test in the write-up. Maybe it's because I am so new, but I've been through that document probably 30 times line by line, and yet every time I remove that entry, it breaks the Authentication. BEGIN RADIUSD -X DEBUG OUTPUT ************************************************************************************************** ************************************************************************************************** ************************************************************************************************** FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Jul 19 2011 at 10:21:08 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 172.16.1.1 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-4507-1" nastype = "cisco" } client 172.16.1.3 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-4507-2" nastype = "cisco" } client 172.16.1.2 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-ASA-5520-01" nastype = "cisco" } client 10.10.0.5 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-2911-VPCRTR" nastype = "cisco" } client 172.16.1.10 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-ASA-5510-GDM" nastype = "cisco" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Instantiating module "ntlm_auth" from file /etc/raddb/modules/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYREALDOMAIN-OMMITTED --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ************************************************************************************************** ************************************************************************************************** ************************************************************************************************** END RADIUSD -X DEBUG OUTPUT Jim C. Julson Sr. Network & Systems Administrator C 208.908.1476 jjulson@marketron.com<mailto:jjulson@marketron.com> [www.marketron.com]<http://www.marketron.com> <http://www.marketron.com> [Learn more about Network Connect]<http://www.marketron.com/network-connect.php?email> The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.
Huh....I've searched all over and haven't seen any reference to that syntax for the users file. Let me give that a shot. Are there any additional modules I would have to configure, or should I be good to go considering I can already authenticate via Active Directory? From: freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org [mailto:freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org] On Behalf Of Nolan King Sent: Friday, June 22, 2012 1:22 PM To: FreeRadius users mailing list Subject: RE: Can't figure out Group Authentication I do it like this, in users file: DEFAULT Ldap-Group == "wifiusers" DEFAULT Auth-Type := Reject Anyone in wifiusers AD security group gets in, all others are rejected. Nolan From: freeradius-users-bounces+nking=mnwd.com@lists.freeradius.org<mailto:freeradius-users-bounces+nking=mnwd.com@lists.freeradius.org> [mailto:freeradius-users-bounces+nking=mnwd.com@lists.freeradius.org]<mailto:[mailto:freeradius-users-bounces+nking=mnwd.com@lists.freeradius.org]> On Behalf Of Julson, Jim Sent: Friday, June 22, 2012 8:32 AM To: freeradius-users@lists.freeradius.org<mailto:freeradius-users@lists.freeradius.org> Subject: Can't figure out Group Authentication First, I'd like to thank Alan for his beyond countless hours of dedication to all the blogs, forum posting, and general support within the community. Your write-ups are thorough and well thought out. I wish more people were like you. I'm pretty new to RADIUS and as consequently, Linux in general. So I might ask questions that seem noobish or lame, but it doesn't mean I'm not willing to learn, research etc. Just bare with me. Now, the problem is this. Following Alan DeKok's guide at http://deployingradius.com/documents/configuration/active_directory.html, I was able to get FreeRADIUS 2.X running on CentOS 6.2 with pretty minimal effort. There were a few things I had to go elsewhere to figure out, but I managed. I have FreeRADIUS setup and authenticating using NTLM_AUTH. I was able to join my AD 2008 R2 Domain, I can list users, groups etc.. This RADIUS server will be for authenticating users on all of our Cisco devices, as well as remote access VPN users. So the problem is this. It's authenticating...a little too well. I've added the following entry into "/etc/raddb/clients.conf" to allow AAA on one of my cisco routers. ************************************* client 10.10.0.5 { secret = REALSECRETOMMITTED shortname = Cisco-2911-VPCRTR nastype = cisco } ************************************* Now, I then setup my Cisco router accordingly, and then did an SSH test to it using my AD Account. Voila! It worked great. However, so did every other "Domain User" account in the environment. This goes back to me being so new to RADIUS and Linux where I don't feel like I'm fully grasping all of the directives within the configuration files, and exactly how they all tie together. I'm getting there, but just not fast enough. So, how do I lock down the SSH Authentication to an Active Directory Group of users, or individual users? Remember, go easy on me. I'll provide whatever you need to help. I'm assuming you will ask for my RADIUSD -X output, so I've attached that as well. NOTE: One thing I don't understand is how in Alan DeKok's write up from the link above, he says don't use the "DEFAULT Auth-Type = ntlm_auth" in the "/etc/raddb/users" file, but yet that's one of the final steps to test in the write-up. Maybe it's because I am so new, but I've been through that document probably 30 times line by line, and yet every time I remove that entry, it breaks the Authentication. BEGIN RADIUSD -X DEBUG OUTPUT ************************************************************************************************** ************************************************************************************************** ************************************************************************************************** FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Jul 19 2011 at 10:21:08 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 172.16.1.1 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-4507-1" nastype = "cisco" } client 172.16.1.3 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-4507-2" nastype = "cisco" } client 172.16.1.2 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-ASA-5520-01" nastype = "cisco" } client 10.10.0.5 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-2911-VPCRTR" nastype = "cisco" } client 172.16.1.10 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-ASA-5510-GDM" nastype = "cisco" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Instantiating module "ntlm_auth" from file /etc/raddb/modules/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYREALDOMAIN-OMMITTED --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ************************************************************************************************** ************************************************************************************************** ************************************************************************************************** END RADIUSD -X DEBUG OUTPUT Jim C. Julson Sr. Network & Systems Administrator C 208.908.1476 jjulson@marketron.com<mailto:jjulson@marketron.com> [www.marketron.com]<http://www.marketron.com> <http://www.marketron.com> [Learn more about Network Connect]<http://www.marketron.com/network-connect.php?email> The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system. The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.
Well, I added that to the top of the /etc/raddb/users file and restarted RADIUS. Here's the debug output. I can clearly see where it's going to the entry at line 2 in the /etc/raddb/users file that reads as follows: Line 1: DEFUALT Ldap-Gorup == "sshadmins" Line 2: DEFAULT Auth-Type := Reject I just don't understand what it is I'm looking at. I see where it says it's executing the authorize section from /etc/raddb/sites-enabled/default and then entering the group, but I don't understand the language from there. I do see that it's looking for the "@" delimiter and it doesn't see it based on how I input my username. I haven't made one configuration change to any of the LDAP modules in RADIUS. So I wasn't so confident from the start that the Line 1 entry would work for me. I'm authenticating against AD via the NTLM_AUTH module. So I'm guessing there's more configuration I need to do?? BEGIN DEBUG OUTPUT ********************************************************************** ********************************************************************** ********************************************************************** rad_recv: Access-Request packet from host 10.10.0.5 port 1645, id=31, length=82 User-Name = "ETRAFFIC\\jjulson" User-Password = "PASSWORDOMMITTED" NAS-Port = 389 NAS-Port-Id = "tty389" NAS-Port-Type = Virtual NAS-IP-Address = 10.10.0.5 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@'<mailto:'@'> in User-Name = "ETRAFFIC\jjulson", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Reject Auth-Type = Reject, rejecting user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ETRAFFIC\jjulson attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 31 to 10.10.0.5 port 1645 Waking up in 4.9 seconds. Cleaning up request 1 ID 31 with timestamp +58 Ready to process requests. ________________________________ From: Julson, Jim Sent: Friday, June 22, 2012 1:59 PM To: FreeRadius users mailing list Subject: RE: Can't figure out Group Authentication Huh….I’ve searched all over and haven’t seen any reference to that syntax for the users file. Let me give that a shot. Are there any additional modules I would have to configure, or should I be good to go considering I can already authenticate via Active Directory? From: freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org [mailto:freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org] On Behalf Of Nolan King Sent: Friday, June 22, 2012 1:22 PM To: FreeRadius users mailing list Subject: RE: Can't figure out Group Authentication I do it like this, in users file: DEFAULT Ldap-Group == "wifiusers" DEFAULT Auth-Type := Reject Anyone in wifiusers AD security group gets in, all others are rejected. Nolan From: freeradius-users-bounces+nking=mnwd.com@lists.freeradius.org<mailto:freeradius-users-bounces+nking=mnwd.com@lists.freeradius.org> [mailto:freeradius-users-bounces+nking=mnwd.com@lists.freeradius.org]<mailto:[mailto:freeradius-users-bounces+nking=mnwd.com@lists.freeradius.org]> On Behalf Of Julson, Jim Sent: Friday, June 22, 2012 8:32 AM To: freeradius-users@lists.freeradius.org<mailto:freeradius-users@lists.freeradius.org> Subject: Can't figure out Group Authentication First, I'd like to thank Alan for his beyond countless hours of dedication to all the blogs, forum posting, and general support within the community. Your write-ups are thorough and well thought out. I wish more people were like you. I'm pretty new to RADIUS and as consequently, Linux in general. So I might ask questions that seem noobish or lame, but it doesn't mean I'm not willing to learn, research etc. Just bare with me. Now, the problem is this. Following Alan DeKok's guide at http://deployingradius.com/documents/configuration/active_directory.html, I was able to get FreeRADIUS 2.X running on CentOS 6.2 with pretty minimal effort. There were a few things I had to go elsewhere to figure out, but I managed. I have FreeRADIUS setup and authenticating using NTLM_AUTH. I was able to join my AD 2008 R2 Domain, I can list users, groups etc.. This RADIUS server will be for authenticating users on all of our Cisco devices, as well as remote access VPN users. So the problem is this. It's authenticating...a little too well. I've added the following entry into "/etc/raddb/clients.conf" to allow AAA on one of my cisco routers. ************************************* client 10.10.0.5 { secret = REALSECRETOMMITTED shortname = Cisco-2911-VPCRTR nastype = cisco } ************************************* Now, I then setup my Cisco router accordingly, and then did an SSH test to it using my AD Account. Voila! It worked great. However, so did every other "Domain User" account in the environment. This goes back to me being so new to RADIUS and Linux where I don't feel like I'm fully grasping all of the directives within the configuration files, and exactly how they all tie together. I'm getting there, but just not fast enough. So, how do I lock down the SSH Authentication to an Active Directory Group of users, or individual users? Remember, go easy on me. I'll provide whatever you need to help. I'm assuming you will ask for my RADIUSD -X output, so I've attached that as well. NOTE: One thing I don't understand is how in Alan DeKok's write up from the link above, he says don't use the "DEFAULT Auth-Type = ntlm_auth" in the "/etc/raddb/users" file, but yet that's one of the final steps to test in the write-up. Maybe it's because I am so new, but I've been through that document probably 30 times line by line, and yet every time I remove that entry, it breaks the Authentication. BEGIN RADIUSD -X DEBUG OUTPUT ************************************************************************************************** ************************************************************************************************** ************************************************************************************************** FreeRADIUS Version 2.1.10, for host x86_64-unknown-linux-gnu, built on Jul 19 2011 at 10:21:08 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 172.16.1.1 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-4507-1" nastype = "cisco" } client 172.16.1.3 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-4507-2" nastype = "cisco" } client 172.16.1.2 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-ASA-5520-01" nastype = "cisco" } client 10.10.0.5 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-2911-VPCRTR" nastype = "cisco" } client 172.16.1.10 { require_message_authenticator = no secret = "REALSECRETOMMITTED" shortname = "Cisco-ASA-5510-GDM" nastype = "cisco" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Instantiating module "ntlm_auth" from file /etc/raddb/modules/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYREALDOMAIN-OMMITTED --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. ************************************************************************************************** ************************************************************************************************** ************************************************************************************************** END RADIUSD -X DEBUG OUTPUT Jim C. Julson Sr. Network & Systems Administrator C 208.908.1476 jjulson@marketron.com<mailto:jjulson@marketron.com> [www.marketron.com]<http://www.marketron.com> <http://www.marketron.com> [Learn more about Network Connect]<http://www.marketron.com/network-connect.php?email> The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system. The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.
Julson, Jim wrote:
Now, I then setup my Cisco router accordingly, and then did an SSH test to it using my AD Account. Voila! It worked great. _*/However, so did every other "Domain User" account in the environment. /*_ This goes back to me being so new to RADIUS and Linux where I don't feel like I'm fully grasping all of the directives within the configuration files, and exactly how they all tie together.
Honestly, I don't remember much of that, either. When I configure the server, I usually go back and read the comments *I wrote* to figure out what to do. But for your issue, you told the server to "use AD to authenticate all users". So that's what it did.
*So, how do I lock down the SSH Authentication to an Active Directory Group of users, or individual users? * Remember, go easy on me. I'll provide whatever you need to help. I'm assuming you will ask for my RADIUSD -X output, so I've attached that as well.
1) configure AD as an LDAP server. See raddb/modules/ldap 2) add "ldap" to the "instantiate" section of radiusd.conf There are references to "ldap" in "authorize" and "authentication" You won't need those. 3) Do group checking with LDAP-Group == "group name" See the FAQ for examples of rejecting users with a particular group. The FAQ uses "Group", which is "Unix group from /etc/passwd". Just use LDAP-Group instead.
NOTE: One thing I don't understand is how in Alan DeKok's write up from the link above, he says don't use the "DEFAULT Auth-Type = ntlm_auth" in the "/etc/raddb/users" file, but yet that's one of the final steps to test in the write-up.
It's an intermediate step. It's necessary only when you're forcing authentication back-ends.
Maybe it's because I am so new, but I've been through that document probably 30 times line by line, and yet every time I remove that entry, it breaks the Authentication.
Yes. The server needs to now HOW to authenticate the users. The incoming RADIUS packet contains what KIND of authentication method. PAP, CHAP, MS-CHAP, etc. So the server has no choice there. But where does it get the passwords from? Normally this is a DB. But AD isn't a DB (for various reasons). Instead, the "Auth-Type = ntlm_auth" reformats and *proxies* the authentication over the Samba protocol, using the ntlm_auth program. i.e. it hands off the MSCHAP stuff to ntlm_auth, and asks "is this correct?" If the server has passwords from a DB, it can just authenticate the user directly. If it doesn't have a password for that user, it has to hand off the authentication to someone else. Alan DeKok.
Alan, That was about the most clear and concise description of the process I've found/heard to date. Thank you for taking the time to educate me. I will attempt to get this going today. I think I have everything that I need at this point. Have a good one. -----Original Message----- From: freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org [mailto:freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Saturday, June 23, 2012 6:22 AM To: FreeRadius users mailing list Subject: Re: Can't figure out Group Authentication Julson, Jim wrote:
Now, I then setup my Cisco router accordingly, and then did an SSH test to it using my AD Account. Voila! It worked great. _*/However, so did every other "Domain User" account in the environment. /*_ This goes back to me being so new to RADIUS and Linux where I don't feel like I'm fully grasping all of the directives within the configuration files, and exactly how they all tie together.
Honestly, I don't remember much of that, either. When I configure the server, I usually go back and read the comments *I wrote* to figure out what to do. But for your issue, you told the server to "use AD to authenticate all users". So that's what it did.
*So, how do I lock down the SSH Authentication to an Active Directory Group of users, or individual users? * Remember, go easy on me. I'll provide whatever you need to help. I'm assuming you will ask for my RADIUSD -X output, so I've attached that as well.
1) configure AD as an LDAP server. See raddb/modules/ldap 2) add "ldap" to the "instantiate" section of radiusd.conf There are references to "ldap" in "authorize" and "authentication" You won't need those. 3) Do group checking with LDAP-Group == "group name" See the FAQ for examples of rejecting users with a particular group. The FAQ uses "Group", which is "Unix group from /etc/passwd". Just use LDAP-Group instead.
NOTE: One thing I don't understand is how in Alan DeKok's write up from the link above, he says don't use the "DEFAULT Auth-Type = ntlm_auth" in the "/etc/raddb/users" file, but yet that's one of the final steps to test in the write-up.
It's an intermediate step. It's necessary only when you're forcing authentication back-ends.
Maybe it's because I am so new, but I've been through that document probably 30 times line by line, and yet every time I remove that entry, it breaks the Authentication.
Yes. The server needs to now HOW to authenticate the users. The incoming RADIUS packet contains what KIND of authentication method. PAP, CHAP, MS-CHAP, etc. So the server has no choice there. But where does it get the passwords from? Normally this is a DB. But AD isn't a DB (for various reasons). Instead, the "Auth-Type = ntlm_auth" reformats and *proxies* the authentication over the Samba protocol, using the ntlm_auth program. i.e. it hands off the MSCHAP stuff to ntlm_auth, and asks "is this correct?" If the server has passwords from a DB, it can just authenticate the user directly. If it doesn't have a password for that user, it has to hand off the authentication to someone else. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.
Okay, so I think I'm getting closer. But I have a few challenges still. I am slowly learning how to parse the RADIUS -X debug output, now it's a matter of knowing what to do with the information. I know that when I've setup Cacti servers or other Linux based servers that bind to LDAP, I've had problems with 2 different facets of the implementation. 1. Domain Groups with spaces sometimes would or wouldn't work. (Is that the case with FreeRADIUS?) 2. Recursive searches were a problem. See below for how the basic Active Directory structure looks for us (Note the spaces in the names). For Cacti, I had to create a new OU, with a new Security Group that didn't have spaces in it. That was the only way I could get LDAP Binds to work for Group Authentication. (I find it hard to belive that's the case with FreeRADIUS...I tend to lean more towards my bad configuration). DOMAIN.EXAMPLE.COM ADMIN - Users ADMIN - Groups ADMIN - Servers Computers Users Domain Controllers Built-In Etc.. So, in that example, if I wanted to have a user be Authenticated who resides in "ADMIN - Users", but the group is in "ADMIN - Groups", does it matter to the RADIUS LDAP module? Now, in /etc/raddb/modules/ldap , we would have the binding setup as follows. Note that the Base DN is the top level of the domain because it has to be able to recursively search all sub-OU's to find both users, and groups. ************************************** /etc/raddb/modules/ldap server = "172.16.5.200" identity = "CN=Administrator,CN=Users,DC=DOMAIN,DC=EXAMPLE,DC=COM" password = MyPasswordForBIND basedn = "DC=DOMAIN,DC=EXAMPLE,DC=COM" filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}}))" #filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" #base_filter = "(objectclass=radiusprofile)" groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=group)(member=%Ldap-UserDn}))(&(objectClass=top)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf ************************************** NOTE: I am kind of lost here. I see so many people using so many different syntaxes that I'm not sure if I'm using the right one. At present, the "users" file is completely default except for the following lines I've added at the very top. So, no matter what my LDAP output shows, If I uncomment the two lines for ntlm_auth, I can login with any Domain User regardless of the top 2 lines that say "Domain Admins", and all others are rejected. So I'm thinking ultimately my problem is not just here, but also with the LDAP bind taking place as you can see below. ************************************** /etc/raddb/users DEFAULT Ldap-Group == "CN=Domain Admins,CN=ADMIN - Groups,DC=DOMAIN,DC=HOME,DC=COM", Auth-Type = ntlm_auth DEFAULT Auth-Type = Reject #DEFAULT Auth-Type = ntlm_auth # Reply-Message = "You have been successfully authenticated! " ************************************** Here's the checklist of what I've done. 1. Added an entry simply as "ldap" under the "Instantiate" section in /etc/raddb/radiusd.conf 2. Added the LDAP information as shown above in /etc/raddb/modules/ldap 3. Configured ntlm_auth under /etc/raddb/modules/ntlm_auth 4. Configured the mschap module under /etc/raddb/modules/mschap 5. Added a list of clients who can authenticate in /etc/raddb/clients.conf 6. Added an entry to check against LDAP groups in /etc/raddb/users (I believe this is still a problem for me. I don't think I have it configured properly. I think I need to visually see an example as it's just not "clicking" with me for some reason. Here's the RADIUSD -X output from my last auth attempt. BEGIN RADIUS - X DEBUG OUTPUT NOTE: I've changed all my domain information for this troubleshooting, and also highlighted anywhere it's referenced. I'm hoping I'm On the right track with what I've highlighted below as to where I believe the problem is. ####################################################################################################### ####################################################################################################### ####################################################################################################### ####################################################################################################### rad_recv: Access-Request packet from host 10.10.0.5 port 1645, id=72, length=73 User-Name = "USERNAMEHERE" User-Password = "PASSWORDOMMITTED" NAS-Port = 389 NAS-Port-Id = "tty389" NAS-Port-Type = Virtual NAS-IP-Address = 10.10.0.5 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "USERNAMEHERE", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] Entering ldap_groupcmp() [files] expand: DC=domain,DC=example,DC=com -> DC=domain,DC=example,DC=com [files] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [files] ... expanding second conditional [files] expand: %{User-Name} -> USERNAMEHERE [files] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=USERNAMEHERE)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 172.16.5.200:389, authentication 0 [ldap] bind as CN=Administrator,CN=Users,DC=domain,DC=example,DC=com/ADMINPASSHERE to 172.16.5.200:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in DC=domain,DC=example,DC=com, with filter (&(sAMAccountName=USERNAMEHERE)) [ldap] rebind to URL ldap://DomainDnsZones.domain.example.com/DC=DomainDnsZones,DC=domain,DC=example,DC=com [ldap] rebind to URL ldap://ForestDnsZones.domain.example.com/DC=ForestDnsZones,DC=domain,DC=example,DC=com [ldap] rebind to URL ldap://domain.example.com/CN=Configuration,DC=domain,DC=example,DC=com [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=group)(member=%Ldap-UserDn}))(&(objectClass=top)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=group)(member=/var/log/radiusdap-UserDn}))(&(objectClass=top)(uniquemember=))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=Domain Admins,CN=Users,DC=example,DC=domain,DC=com, with filter (|(&(objectClass=group)(member=/var/log/radiusdap-UserDn}))(&(objectClass=top)(uniquemember=))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=USER HERE,OU=Admin-Sec_Groups,DC=example,DC=domain,DC=com, with filter (objectclass=*) [ldap] performing search in CN=SSHADMINS,OU=Security Groups,OU=ADMIN - Groups, DC=example,DC=domain,DC=com, with filter (cn=CN=Domain Admins,CN=Users,DC=example,DC=domain,DC=com) [ldap] object not found [ldap] performing search in CN=VPN Users,OU=Security Groups,OU=ADMIN - Groups, DC=example,DC=domain,DC=com, with filter (cn=CN=Domain Admins,CN=Users,DC=example,DC=domain,DC=com) [ldap] object not found [ldap] performing search in CN=Cacti_Users,OU=Admin-Sec_Groups,DC=example,DC=domain,DC=com, with filter (cn=CN=Domain Admins,CN=Users,DC=example,DC=domain,DC=com) [ldap] object not found [ldap] performing search in CN=HSP Admins,OU=ASP Security Groups,DC=example,DC=domain,DC=com, with filter (cn=CN=Domain Admins,CN=Users,DC=example,DC=domain,DC=com) [ldap] object not found [ldap] performing search in CN=LoginWeb,CN=Users,DC=example,DC=domain,DC=com, with filter (cn=CN=Domain Admins,CN=Users,DC=example,DC=domain,DC=com) [ldap] object not found [ldap] performing search in CN=SSO,OU=ASP Security Groups,DC=example,DC=domain,DC=com, with filter (cn=CN=Domain Admins,CN=Users,DC=example,DC=domain,DC=com) [ldap] object not found [ldap] performing search in CN=Schema Admins,CN=Users,DC=example,DC=domain,DC=com, with filter (cn=CN=Domain Admins,CN=Users,DC=example,DC=domain,DC=com) [ldap] object not found [ldap] performing search in CN=Enterprise Admins,CN=Users,DC=example,DC=domain,DC=com, with filter (cn=CN=Domain Admins,CN=Users,DC=example,DC=domain,DC=com) [ldap] object not found [ldap] performing search in CN=Domain Users,CN=Users,DC=example,DC=domain,DC=com, with filter (cn=CN=Domain Admins,CN=Users,DC=example,DC=domain,DC=com) [ldap] object not found ########################################################################################## Now this just isn't true...Below, highlighted in green it says the username is authorized for remote access... rlm_ldap::groupcmp: Group CN=Domain Admins,CN=Users, DC=example,DC=domain,DC=com not found or user not a member ########################################################################################## [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop [ldap] performing user authorization for USERNAMEHERE [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> USERNAMEHERE [ldap] expand: (&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})) -> (&(sAMAccountName=USERNAMEHERE)) [ldap] expand: DC=example,DC=domain,DC=com -> DC=example,DC=domain,DC=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in DC=example,DC=domain,DC=com, with filter (&(sAMAccountName=USERNAMEHERE)) [ldap] rebind to URL ldap://DomainDnsZones.domain.example.com/DC=DomainDnsZones,DC=example,DC=domain,DC=com [ldap] rebind to URL ldap://ForestDnsZones.domain.example.com/DC=ForestDnsZones,DC=example,DC=domain,DC=com [ldap] rebind to URL ldap://domain.example.com/CN=Configuration,DC=example,DC=domain,DC=com [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user USERNAMEHERE authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ################################################################### Is this what the actual problem is? Looks like it to me. I thought I addressed this with the line I put in /etc/raddb/users stating that the Auth-Type = ntlm_auth was good for Ldap-Group "Domain Admins" Is my syntax wrong? ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} #################################################################### [attr_filter.access_reject] expand: %{User-Name} ->USERNAMEHERE attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 72 to 10.10.0.5 port 1645 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 72 with timestamp +10 Ready to process requests. ####################################################################################################### ####################################################################################################### ####################################################################################################### ####################################################################################################### END OF RADIUSD -X DEBUG OUTPUT -----Original Message----- From: freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org [mailto:freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org] On Behalf Of Julson, Jim Sent: Saturday, June 23, 2012 7:44 AM To: FreeRadius users mailing list Subject: RE: Can't figure out Group Authentication Alan, That was about the most clear and concise description of the process I've found/heard to date. Thank you for taking the time to educate me. I will attempt to get this going today. I think I have everything that I need at this point. Have a good one. -----Original Message----- From: freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org<mailto:freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org> [mailto:freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org]<mailto:[mailto:freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org]> On Behalf Of Alan DeKok Sent: Saturday, June 23, 2012 6:22 AM To: FreeRadius users mailing list Subject: Re: Can't figure out Group Authentication Julson, Jim wrote:
Now, I then setup my Cisco router accordingly, and then did an SSH test to it using my AD Account. Voila! It worked great. _*/However, so did every other "Domain User" account in the environment. /*_ This goes back to me being so new to RADIUS and Linux where I don't feel like I'm fully grasping all of the directives within the configuration files, and exactly how they all tie together.
Honestly, I don't remember much of that, either. When I configure the server, I usually go back and read the comments *I wrote* to figure out what to do. But for your issue, you told the server to "use AD to authenticate all users". So that's what it did.
*So, how do I lock down the SSH Authentication to an Active Directory Group of users, or individual users? * Remember, go easy on me. I'll provide whatever you need to help. I'm assuming you will ask for my RADIUSD -X output, so I've attached that as well.
1) configure AD as an LDAP server. See raddb/modules/ldap 2) add "ldap" to the "instantiate" section of radiusd.conf There are references to "ldap" in "authorize" and "authentication" You won't need those. 3) Do group checking with LDAP-Group == "group name" See the FAQ for examples of rejecting users with a particular group. The FAQ uses "Group", which is "Unix group from /etc/passwd". Just use LDAP-Group instead.
NOTE: One thing I don't understand is how in Alan DeKok's write up from the link above, he says don't use the "DEFAULT Auth-Type = ntlm_auth" in the "/etc/raddb/users" file, but yet that's one of the final steps to test in the write-up.
It's an intermediate step. It's necessary only when you're forcing authentication back-ends.
Maybe it's because I am so new, but I've been through that document probably 30 times line by line, and yet every time I remove that entry, it breaks the Authentication.
Yes. The server needs to now HOW to authenticate the users. The incoming RADIUS packet contains what KIND of authentication method. PAP, CHAP, MS-CHAP, etc. So the server has no choice there. But where does it get the passwords from? Normally this is a DB. But AD isn't a DB (for various reasons). Instead, the "Auth-Type = ntlm_auth" reformats and *proxies* the authentication over the Samba protocol, using the ntlm_auth program. i.e. it hands off the MSCHAP stuff to ntlm_auth, and asks "is this correct?" If the server has passwords from a DB, it can just authenticate the user directly. If it doesn't have a password for that user, it has to hand off the authentication to someone else. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.
Julson, Jim wrote:
Okay, so I think I’m getting closer. But I have a few challenges still. I am slowly learning how to parse the RADIUS –X debug output, now it’s a matter of knowing what to do with the information.
Use the handy form at: networkradius.com/freeradius.html It tells you the important things to look at.
1. Domain Groups with spaces sometimes would or wouldn't work. (Is that the case with FreeRADIUS?)
It shouldn't be, but you never know.
2. Recursive searches were a problem. See below for how the basic Active Directory structure looks for us (Note the spaces in the names). For Cacti, I had to create a new OU, with a new Security Group that didn’t have spaces in it. That was the only way I could get LDAP Binds to work for Group Authentication. (I find it hard to belive that’s the case with FreeRADIUS…I tend to lean more towards my bad configuration).
Recursive searches are supported in FreeRADIUS. See the "rebind" configuration in the ldap module.
So, in that example, if I wanted to have a user be Authenticated who resides in “ADMIN – Users”, but the group is in “ADMIN – Groups”, does it matter to the RADIUS LDAP module?
It shouldn't.
NOTE: I am kind of lost here. I see so many people using so many different syntaxes that I’m not sure if I’m using the right one.
The documentation is correct. Almost every third-party site is wrong.
At present, the “users” file is completely default except for the following lines I’ve added at the very top. So, no matter what my LDAP output shows, If I uncomment the two lines for ntlm_auth, I can login with any Domain User regardless of the top 2 lines that say “Domain Admins”, and all others are rejected. So I’m thinking ultimately my problem is not just here, but also with the LDAP bind taking place as you can see below. ************************************** */etc/raddb/users** *
DEFAULT Ldap-Group == "CN=Domain Admins,CN=ADMIN - Groups,DC=DOMAIN,DC=HOME,DC=COM",
You just need the group name "admin" or "sales". Not the whole path.
Auth-Type = ntlm_auth DEFAULT Auth-Type = Reject
You don't need the default reject. The server will ALWAYS reject people it doesn't know.
Here’s the RADIUSD –X output from my last auth attempt.
BEGIN RADIUS – X DEBUG OUTPUT NOTE: I’ve changed all my domain information for this troubleshooting, and also highlighted anywhere it’s referenced. I’m hoping I’m On the right track with what I’ve highlighted below as to where I believe the problem is.
Part of the reason for the debug output is to show you what's going on. It prints out the LDAP queries it does. You can copy them, and use them in command-line tests with "ldapsearch". That helps. Alan DeKok.
Thank you once again Alan. I know you probably have to "face palm" yourself sometimes when you see the same questions over and over. I appreciate your patience with me. I don't want someone to do it for me, I want to learn it so I can support it. I have decided to start fresh. I had clean copies of every file I've ever touched, so I'm going to try to tackle this sometime during the week. This Amazon AWS Cloud VPC isn't going to build itself :) -----Original Message----- From: freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org [mailto:freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Monday, June 25, 2012 6:54 AM To: FreeRadius users mailing list Subject: Re: Can't figure out Group Authentication Julson, Jim wrote:
Okay, so I think I’m getting closer. But I have a few challenges still. I am slowly learning how to parse the RADIUS –X debug output, now it’s a matter of knowing what to do with the information.
Use the handy form at: networkradius.com/freeradius.html It tells you the important things to look at.
1. Domain Groups with spaces sometimes would or wouldn't work. (Is that the case with FreeRADIUS?)
It shouldn't be, but you never know.
2. Recursive searches were a problem. See below for how the basic Active Directory structure looks for us (Note the spaces in the names). For Cacti, I had to create a new OU, with a new Security Group that didn’t have spaces in it. That was the only way I could get LDAP Binds to work for Group Authentication. (I find it hard to belive that’s the case with FreeRADIUS…I tend to lean more towards my bad configuration).
Recursive searches are supported in FreeRADIUS. See the "rebind" configuration in the ldap module.
So, in that example, if I wanted to have a user be Authenticated who resides in “ADMIN – Users”, but the group is in “ADMIN – Groups”, does it matter to the RADIUS LDAP module?
It shouldn't.
NOTE: I am kind of lost here. I see so many people using so many different syntaxes that I’m not sure if I’m using the right one.
The documentation is correct. Almost every third-party site is wrong.
At present, the “users” file is completely default except for the following lines I’ve added at the very top. So, no matter what my LDAP output shows, If I uncomment the two lines for ntlm_auth, I can login with any Domain User regardless of the top 2 lines that say “Domain Admins”, and all others are rejected. So I’m thinking ultimately my problem is not just here, but also with the LDAP bind taking place as you can see below. ************************************** */etc/raddb/users** *
DEFAULT Ldap-Group == "CN=Domain Admins,CN=ADMIN - Groups,DC=DOMAIN,DC=HOME,DC=COM",
You just need the group name "admin" or "sales". Not the whole path.
Auth-Type = ntlm_auth DEFAULT Auth-Type = Reject
You don't need the default reject. The server will ALWAYS reject people it doesn't know.
Here’s the RADIUSD –X output from my last auth attempt.
BEGIN RADIUS – X DEBUG OUTPUT NOTE: I’ve changed all my domain information for this troubleshooting, and also highlighted anywhere it’s referenced. I’m hoping I’m On the right track with what I’ve highlighted below as to where I believe the problem is.
Part of the reason for the debug output is to show you what's going on. It prints out the LDAP queries it does. You can copy them, and use them in command-line tests with "ldapsearch". That helps. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.
Il 22/06/2012 17:32, Julson, Jim ha scritto:
Now, the problem is this. Following Alan DeKok's guide at http://deployingradius.com/documents/configuration/active_directory.html, I was able to get FreeRADIUS 2.X running on CentOS 6.2 with pretty minimal effort. There were a few things I had to go elsewhere to figure out, but I managed. I have FreeRADIUS setup and authenticating using NTLM_AUTH. I was able to join my AD 2008 R2 Domain, I can list users, groups etc.. This RADIUS server will be for authenticating users on all of our Cisco devices, as well as remote access VPN users. So the problem is this. It's authenticating...a little too well. Why not add a "default group" var (to be overridden for specific clients) and pass it to ntlm_auth in "--require-membership-of=" parameter? That way you can filter who can authenticate from any NAS. And IIUC huntgroups, you can even define groups of clients...
Please correct me if I'm wrong. BYtE, Diego.
Forgive my ignorance, but the variable that you are suggesting I use would be something that I had to create locally on my RADIUS servers right? The idea is that we use our central point of management which in our case is Active Directory. We have hundreds of servers ranging from RHEL 3 up to Ubuntu 12.04 as well as Windows boxes. So managing groups on a "per radius server" basis isn't really a good choice from a management perspective. Using the Active Directory domain, we can have our admins move folks in and out of groups as necessary. Did I understand your suggestion right? Or is that variable "--require-membership-of=" something that can help me achieve what I want to do? I thought I had to use LDAP for Group Authorization... -----Original Message----- From: freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org [mailto:freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org] On Behalf Of NdK Sent: Tuesday, June 26, 2012 3:36 AM To: freeradius-users@lists.freeradius.org Subject: Re: Can't figure out Group Authentication Il 22/06/2012 17:32, Julson, Jim ha scritto:
Now, the problem is this. Following Alan DeKok's guide at http://deployingradius.com/documents/configuration/active_directory.html, I was able to get FreeRADIUS 2.X running on CentOS 6.2 with pretty minimal effort. There were a few things I had to go elsewhere to figure out, but I managed. I have FreeRADIUS setup and authenticating using NTLM_AUTH. I was able to join my AD 2008 R2 Domain, I can list users, groups etc.. This RADIUS server will be for authenticating users on all of our Cisco devices, as well as remote access VPN users. So the problem is this. It's authenticating...a little too well.
Why not add a "default group" var (to be overridden for specific clients) and pass it to ntlm_auth in "--require-membership-of=" parameter? That way you can filter who can authenticate from any NAS. And IIUC huntgroups, you can even define groups of clients... Please correct me if I'm wrong. BYtE, Diego. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.
Hi... i able to get the openldap group authentication + PAP with radius , i used the following settings , in users file , DEFAULT Ldap-Group == "cn=staff,ou=groups,dc=openldap,dc=ihk,dc=com" Reply-Message = "You are Accepted" DEFAULT Auth-Type := Reject and in /etc/freeradius/moduls/ldap server = "ldap.ihx.com" identity = "cn=admin,dc=openldap,dc=ihx,dc=com" password = abc basedn = "dc=openldap,dc=ihx,dc=com" filter = "(mail=%{Stripped-User-Name:-%{User-Name}})" access_attr = "mail" authtype = ldap and uncomment the following lines in the /etc/freeradius/modules/ldap groupname_attribute groupmembership_filter groupmembership_attribute hope this helps, Thank You On 26 June 2012 20:44, Julson, Jim <jjulson@marketron.com> wrote:
Forgive my ignorance, but the variable that you are suggesting I use would be something that I had to create locally on my RADIUS servers right? The idea is that we use our central point of management which in our case is Active Directory. We have hundreds of servers ranging from RHEL 3 up to Ubuntu 12.04 as well as Windows boxes. So managing groups on a "per radius server" basis isn't really a good choice from a management perspective. Using the Active Directory domain, we can have our admins move folks in and out of groups as necessary.
Did I understand your suggestion right? Or is that variable "--require-membership-of=" something that can help me achieve what I want to do? I thought I had to use LDAP for Group Authorization...
-----Original Message----- From: freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org[mailto: freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org] On Behalf Of NdK Sent: Tuesday, June 26, 2012 3:36 AM To: freeradius-users@lists.freeradius.org Subject: Re: Can't figure out Group Authentication
Il 22/06/2012 17:32, Julson, Jim ha scritto:
Now, the problem is this. Following Alan DeKok's guide at http://deployingradius.com/documents/configuration/active_directory.html, I was able to get FreeRADIUS 2.X running on CentOS 6.2 with pretty minimal effort. There were a few things I had to go elsewhere to figure out, but I managed. I have FreeRADIUS setup and authenticating using NTLM_AUTH. I was able to join my AD 2008 R2 Domain, I can list users, groups etc.. This RADIUS server will be for authenticating users on all of our Cisco devices, as well as remote access VPN users. So the problem is this. It's authenticating...a little too well.
Why not add a "default group" var (to be overridden for specific clients) and pass it to ntlm_auth in "--require-membership-of=" parameter? That way you can filter who can authenticate from any NAS. And IIUC huntgroups, you can even define groups of clients...
Please correct me if I'm wrong.
BYtE, Diego. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I appreciate the configuration and the help. Unfortunately the syntax will be a little different for the LDAP module since I'm querying a Microsoft Active Directory and not an OpenLDAP Server. The filters, access attributes and other various settings are completely different from what Microsoft passes in their LDAP Attributes. Again, thank you for the input though. If anyone else has what they use for their Filters, I'd absolutely appreciate a working reference from /etc/raddb/modules/ldap . I think that's my one main problem. Thanks! From: freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org [mailto:freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org] On Behalf Of dhanushka ranasinghe Sent: Tuesday, June 26, 2012 9:51 PM To: FreeRadius users mailing list Subject: Re: Can't figure out Group Authentication Hi... i able to get the openldap group authentication + PAP with radius , i used the following settings , in users file , DEFAULT Ldap-Group == "cn=staff,ou=groups,dc=openldap,dc=ihk,dc=com" Reply-Message = "You are Accepted" DEFAULT Auth-Type := Reject and in /etc/freeradius/moduls/ldap server = "ldap.ihx.com<http://ldap.ihx.com>" identity = "cn=admin,dc=openldap,dc=ihx,dc=com" password = abc basedn = "dc=openldap,dc=ihx,dc=com" filter = "(mail=%{Stripped-User-Name:-%{User-Name}})" access_attr = "mail" authtype = ldap and uncomment the following lines in the /etc/freeradius/modules/ldap groupname_attribute groupmembership_filter groupmembership_attribute hope this helps, Thank You On 26 June 2012 20:44, Julson, Jim <jjulson@marketron.com<mailto:jjulson@marketron.com>> wrote: Forgive my ignorance, but the variable that you are suggesting I use would be something that I had to create locally on my RADIUS servers right? The idea is that we use our central point of management which in our case is Active Directory. We have hundreds of servers ranging from RHEL 3 up to Ubuntu 12.04 as well as Windows boxes. So managing groups on a "per radius server" basis isn't really a good choice from a management perspective. Using the Active Directory domain, we can have our admins move folks in and out of groups as necessary. Did I understand your suggestion right? Or is that variable "--require-membership-of=" something that can help me achieve what I want to do? I thought I had to use LDAP for Group Authorization... -----Original Message----- From: freeradius-users-bounces+jjulson=marketron.com@lists.freeradius.org<mailto:marketron.com@lists.freeradius.org> [mailto:freeradius-users-bounces+jjulson<mailto:freeradius-users-bounces%2Bjjulson>=marketron.com@lists.freeradius.org<mailto:marketron.com@lists.freeradius.org>] On Behalf Of NdK Sent: Tuesday, June 26, 2012 3:36 AM To: freeradius-users@lists.freeradius.org<mailto:freeradius-users@lists.freeradius.org> Subject: Re: Can't figure out Group Authentication Il 22/06/2012 17:32, Julson, Jim ha scritto:
Now, the problem is this. Following Alan DeKok's guide at http://deployingradius.com/documents/configuration/active_directory.html, I was able to get FreeRADIUS 2.X running on CentOS 6.2 with pretty minimal effort. There were a few things I had to go elsewhere to figure out, but I managed. I have FreeRADIUS setup and authenticating using NTLM_AUTH. I was able to join my AD 2008 R2 Domain, I can list users, groups etc.. This RADIUS server will be for authenticating users on all of our Cisco devices, as well as remote access VPN users. So the problem is this. It's authenticating...a little too well.
Why not add a "default group" var (to be overridden for specific clients) and pass it to ntlm_auth in "--require-membership-of=" parameter? That way you can filter who can authenticate from any NAS. And IIUC huntgroups, you can even define groups of clients... Please correct me if I'm wrong. BYtE, Diego. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html The information contained in this e-mail message may be confidential and protected from disclosure. If you are not the intended recipient, any dissemination, distribution or copying is strictly prohibited. If you think that you have received this e-mail message in error, please notify the sender immediately by replying to this message and then delete it from your system.
Il 26/06/2012 17:14, Julson, Jim ha scritto:
Forgive my ignorance, but the variable that you are suggesting I use would be something that I had to create locally on my RADIUS servers right? The idea is that we use our central point of management which in our case is Active Directory. You have to define a local variable to hold the group name (or the group SID, but while making auth faster it makes management harder). Then assign to it a value based on where you receive your request from (a switch, a "public" server, a "private" server, a VPN endpoint...) and pass it to ntlm_auth in -require-membership-of option. If the user trying to access is not in that group, he's denied access (ntlm_auth checks group membership in AD).
We have hundreds of servers ranging from RHEL 3 up to Ubuntu 12.04 as well as Windows boxes. So managing groups on a "per radius server" basis isn't really a good choice from a management perspective. Using the Active Directory domain, we can have our admins move folks in and out of groups as necessary. That's exactly what AD is for. But I usually join the PCs to it so I can have better integration (one for all: AD groups gets mapped to Unix groups).
Did I understand your suggestion right? I don't think so. Or is that variable "--require-membership-of=" That's not a variable, that's a parameter for ntlm_auth. something that can help me achieve what I want to do? It restrict access to members of that group. IIUC that's what you need.
I thought I had to use LDAP for Group Authorization... You don't need to. At least not for such a basic thing.
To be more clear (not actually tested): 1) add "ATTRIBUTE Require-Group 3000 string" to dictionary 2) add "DEFAULT Require-Group := 'default-ad-group'" to users 3) change ntlm_auth line in modules/mschap to include "--require-membership-of=%{Require-Group}" Now restart FR and it should accept only users in 'default-ad-group'. If it's OK. now you have to find "some way" to differentiate the NAS (or NAS group) from where the user is requesting access and use unlang to change Require-Group value as needed. BYtE, Diego.
participants (5)
-
Alan DeKok -
dhanushka ranasinghe -
Julson, Jim -
NdK -
Nolan King