Exec and ntlm_auth

freeradius at corwyn.net freeradius at corwyn.net
Mon Nov 30 17:21:32 CET 2009


At 11:13 PM 11/29/2009, freeradius at corwyn.net wrote:

A resummary:
Goal: Authenticate and Authorize users that telnet into the switches 
in Groups A and/or B based on their inclusion in a specific AD 
security group for A & B .

Environment:
CentOS 5.2  (IP 10.10.0.1)

freeradius2-2.1.7-2.el5
freeradius2-utils-2.1.7-2.el5
freeradius2-libs-2.1.7-2.el5
freeradius2-ldap-2.1.7-2.el5

Cisco switch running IOS 12.4 in subnet A (10.100.0.0/24)
Cisco switch running IOS 12.4 in subnet B (10.101.0.0/24)

windows Active Directory (example.com) with Security Groups A & B

Add to modules{} inradiusd.conf:
exec ntlm_auth {
                 wait = yes
                 program = "/usr/bin/ntlm_auth --request-nt-key 
--domain=example.com --username=%{mschap:User-Name} 
--password=%{User-Password}"
         }

Copy:
./raddb/sites-available/default to ./raddb/sites-available/server_A 
and link it to ./raddb/sites-enabled/server_A
./raddb/sites-available/default to ./raddb/sites-available/server_B 
and link it to ./raddb/sites-enabled/server_B

and then surround the contents of those files with
server server_A {..}
and
server server_B {..}
respectively

Add to the authenticate{} section of ./server_A and ./server_B :

ntlm_auth

Edit ./modules/ldap to:
ldap {
         server = "example.com"
         identity = "CN=user,OU=Enterprise,DC=example,DC=com"
         password = xxx
         basedn = "OU=Enterprise,DC=example,DC=com"
         filter = 
(&(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})(objectClass=person))
         groupmembership_filter 
="(&(objectClass=group)(member=%{Ldap-UserDn}))"
         groupmembership_attribute = "memberOf"

         groupname_attribute = cn
         groupmembership_filter = 
"(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))"
         groupmembership_attribute = "memberOf"


...
}


Add to top of ./raddb/users:

DEFAULT     Ldap-Group == "UserGroup",Service-Type = 
NAS-Prompt-User,cisco-avpair = "shell:priv-lvl=15"
DEFAULT     Auth-Type = ntlm_auth


Add to ./raddb/cilents.conf:
clients disambiguate {
client localhost {
         #  Allowed values are:
         #       dotted quad (1.2.3.4)
         #       hostname    (radius.example.com)
         ipaddr = 127.0.0.1

client Cisco_A {
         ipaddr = 10.101.0.0
         netmask = 24
         secret = testing123
         virtual_server = server_A
}
client Cisco_B {
         ipaddr = 10.100.0.0
         netmask = 24
         secret = testing123
         virtual_server = server_B
}


Add to the listen{} section of radiusd.conf:
clients = disambiguate


On the cisco switches A & B:

aaa new-model
aaa group server radius RAD
  server 10.10.0.1 auth-port 1812 acct-port 1813
!
aaa authentication login default group radius line
aaa authentication enable default group radius enable
aaa authorization exec default group radius none
radius-server host 10.10.0.1 auth-port 1812 acct-port 1813 timeout 3
radius-server retransmit 2
radius-server key 7 encrypted-secret



that configuration still fails to authorize, even tho the output of 
radiusd -X looks like its working (sanitized)



rad_recv: Access-Request packet from host 10.100.0.8 port 1812, 
id=80, length=79
         NAS-IP-Address = 10.100.0.8
         NAS-Port = 1
         NAS-Port-Type = Virtual
         User-Name = "testuser"
         Calling-Station-Id = "10.100.0.5"
         User-Password = "password"
server server_cisco {
+- entering group authorize {...}
++[preprocess] returns ok
++[mschap] returns noop
rlm_ldap: Entering ldap_groupcmp()
[files]         expand: OU=Enterprise,DC=example,DC=com -> 
OU=Enterprise,DC=example,DC=com
[files] WARNING: Deprecated conditional expansion ":-".  See "man 
unlang" for details
[files]         expand: 
(&(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})(objectClass=person)) 
-> (&(sAMAccountname=testuser)(objectClass=person))
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to example.com:389, authentication 0
rlm_ldap: bind as 
CN=_radiususer,OU=Enterprise,DC=example,DC=com/wxxxxx to example.com:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: performing search in OU=Enterprise,DC=example,DC=com, with 
filter (&(sAMAccountname=testuser)(objectClass=person))
rlm_ldap: ldap_release_conn: Release Id: 0
[files]         expand: 
(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) 
-> 
(|(&(objectClass=GroupOfNames)(member=CN\3dRick\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\2cDC\3dexample\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRickOU\3dUsers\2cOU\3dEnterprise\DC\3dexample\2cDC\3dcom)))
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in OU=Enterprise,DC=example,DC=com, with 
filter 
(&(cn=Infrastructure)(|(&(objectClass=GroupOfNames)(member=CN\3dRick\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRick\2cOU\3dIS\2cOU\3dUsers\2cOU\3dEnterprise\2cDC\3dint\2cDC\3dexample\2cDC\3dcom))))
rlm_ldap: object not found
rlm_ldap: ldap_release_conn: Release Id: 0
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in 
CN=Rick,OU=Enterprise,DC=example,DC=com, with filter (objectclass=*)
rlm_ldap: performing search in CN=Infrastructure,OU=Security 
Groups,OU=Enterprise,DC=example,DC=com, with filter (cn=Infrastructure)
rlm_ldap::ldap_groupcmp: User found in group Infrastructure
rlm_ldap: ldap_release_conn: Release Id: 0
[files] users: Matched entry DEFAULT at line 5
++[files] returns ok
[ldap] performing user authorization for testuser
[ldap] WARNING: Deprecated conditional expansion ":-".  See "man 
unlang" for details
[ldap]  expand: 
(&(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})(objectClass=person)) 
-> (&(sAMAccountname=testuser)(objectClass=person))
[ldap]  expand: OU=Enterprise,DC=example,DC=com -> 
OU=Enterprise,DC=example,DC=com
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: performing search in OU=Enterprise,DC=example,DC=com, with 
filter (&(sAMAccountname=testuser)(objectClass=person))
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP.  Are you sure 
that the user is configured correctly?
[ldap] user testuser authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
++[ldap] returns ok
[pap] WARNING! No "known good" password found for the 
user.  Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = ntlm_auth
+- entering group authenticate {...}
[ntlm_auth]     expand: --username=%{mschap:User-Name} -> --username=testuser
[ntlm_auth]     expand: --password=%{User-Password} -> --password=password
Exec-Program output: NT_STATUS_OK: Success (0x0)
Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0)
Exec-Program: returned: 0
++[ntlm_auth] returns ok
+- entering group post-auth {...}
++[exec] returns noop
} # server server_cisco
Sending Access-Accept of id 80 to 10.100.0.8 port 1812
Finished request 0.
Going to the next request
Waking up in 5.0 seconds.
Cleaning up request 0 ID 80 with timestamp +7
Ready to process requests.





If I removing authorization from the Cisco config to:
no aaa authorization exec default group radius none

and then I can log in.

At the top of ./users:
rsteeves   Cleartext-Password := "xxx"
            Service-Type = NAS-Prompt-User,
            cisco-avpair = "shell:priv-lvl=15"

also succeeds in logging in, so the issues are in ldap somewhere.


But I feel like I'm CLOSE. 




More information about the Freeradius-Users mailing list