Hey List, I was just wondering - I have setup a freeradius server (stock packages on SLES 11, I don't have the exact version athand since I don't have access to the server right now) which is used for mac-based authentication with cisco switches - including vlan assignment. This works as intended. But I would also like to centralize my user accounts for switches and routers - am I able to do this with the same radius setup? Or do I have to setup another radius server? I am currently using flatfiles for the mac authentication. I already checked the list archive and the wiki but couldn't find anything helpful - maybe I looked for the wrong keywords ;) Any help would be appreciated! -- Mit freundlichen Grüßen/With Kind Regards Rudolph Bott
Am 19.11.2010 17:01, schrieb Alan DeKok:
Rudolph Bott wrote:
But I would also like to centralize my user accounts for switches and routers - am I able to do this with the same radius setup?
Yes.
Ah yes, thanks - any hints on how to achieve this? Maybe I'm just using the wrong keywords for searching.
Alan DeKok.
-- Mit freundlichen Grüßen/With kind regards Rudolph Bott
Rudolph Bott wrote:
Ah yes, thanks - any hints on how to achieve this? Maybe I'm just using the wrong keywords for searching.
(a) configure user authentication (b) configure MAC authentication There is no real difference between the two, other than the format of the User-Name attribute. If your question was more specific, my answers could be more detailed. Alan DeKok.
Hi Alan, ok I'll try to be more specific: I have all the mac addresses (including the vlan attribute) in my users file. Can I just put in some user accounts as well and configure my switches to use the radius server for user authentication? How do I separate the management-users from my 'fake' mac-address-users? I don't wont anyone to login to my switches with his mac address :/ On top of that, I might also need a Radius server to authenticate wireless users against Active Directory but I'll probably use IAS here (unless its easy to add this feature to the existing freeradius setup as well). Basically my question is: how can I separate user requests for different backends (mac-address-users-file, switch-users-file, active directory backend) on my radius server. Simply running 3 instances with different ports/configurations on the same server is probably not the way to go (is it?) On 19.11.2010 20:42, Alan DeKok wrote:
Rudolph Bott wrote:
Ah yes, thanks - any hints on how to achieve this? Maybe I'm just using the wrong keywords for searching.
(a) configure user authentication (b) configure MAC authentication
There is no real difference between the two, other than the format of the User-Name attribute.
If your question was more specific, my answers could be more detailed.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Mit freundlichen Grüßen / With Kind Regards Rudolph Bott
Hey Alan, On 20.11.2010 11:26, Rudolph Bott wrote:
Hi Alan,
ok I'll try to be more specific:
I have all the mac addresses (including the vlan attribute) in my users file. Can I just put in some user accounts as well and configure my switches to use the radius server for user authentication?
How do I separate the management-users from my 'fake' mac-address-users? I don't wont anyone to login to my switches with his mac address :/
OK forget about that part - I totally forgot about the 'Service-Type' attribute, sorry! But that actually leads to my next question: is there a way to avoid having cleartext passwords for my switch-users in the users file? However, there's still need for clarification on the following:
On top of that, I might also need a Radius server to authenticate wireless users against Active Directory but I'll probably use IAS here (unless its easy to add this feature to the existing freeradius setup as well).
Basically my question is: how can I separate user requests for different backends (mac-address-users-file, switch-users-file, active directory backend) on my radius server. Simply running 3 instances with different ports/configurations on the same server is probably not the way to go (is it?)
On 19.11.2010 20:42, Alan DeKok wrote:
Rudolph Bott wrote:
Ah yes, thanks - any hints on how to achieve this? Maybe I'm just using the wrong keywords for searching.
(a) configure user authentication (b) configure MAC authentication
There is no real difference between the two, other than the format of the User-Name attribute.
If your question was more specific, my answers could be more detailed.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Mit freundlichen Grüßen / With Kind Regards Rudolph Bott
Rudolph Bott wrote:
I have all the mac addresses (including the vlan attribute) in my users file. Can I just put in some user accounts as well and configure my switches to use the radius server for user authentication?
Yes.
How do I separate the management-users from my 'fake' mac-address-users? I don't wont anyone to login to my switches with his mac address :/
Look at the packets for the two kinds of requests. They will *look* different. Use those differences to create a policy that separates the two. Very often, the MAC auth requests have User-Password or CHAP-Password of the Mac address. Since the User-Name also looks like a MAC address, that's a pretty good way to tell them apart.
On top of that, I might also need a Radius server to authenticate wireless users against Active Directory but I'll probably use IAS here (unless its easy to add this feature to the existing freeradius setup as well).
It's trivial. Add a name/password to the "users" file. Start the server in debugging mode. PEAP will work.
Basically my question is: how can I separate user requests for different backends (mac-address-users-file, switch-users-file, active directory backend) on my radius server. Simply running 3 instances with different ports/configurations on the same server is probably not the way to go (is it?)
Nope.
But that actually leads to my next question: is there a way to avoid having cleartext passwords for my switch-users in the users file?
Sure. Put them in a database. Alan DeKok.
participants (2)
-
Alan DeKok -
Rudolph Bott