Freeradius AD LDAP Authentication: Difference between revisions
From falz.net
No edit summary |
No edit summary |
||
Line 8: | Line 8: | ||
** network-administrators: full admin/config access | ** network-administrators: full admin/config access | ||
== AD Configuration== | |||
* Create an AD user for freeradius application to bind to LDAP. Let's call it 'freeradius'. Maybe you don't want the password to expire as well. | |||
== FreeRadius / Centos Config == | |||
* Install freeradius packages on your centos-ey server: | * Install freeradius packages on your centos-ey server: | ||
** yum install freeradius freeradius-ldap | ** yum install freeradius freeradius-ldap | ||
* /etc/raddb/modules/ldap: | * /etc/raddb/modules/ldap: | ||
Line 59: | Line 62: | ||
} | } | ||
== Router Config == | |||
Not going into detail of your router configs, but they will have to be configured to point to your RADIUS server. | |||
On the Juniper side the "op" and "superuser" referenced above will have to map to some classes and users: | |||
system { | system { |
Revision as of 15:35, 7 March 2017
FreeRadius2 LDAP auth to Win2k12 AD for Cisco/Juniper login authentication.
- Have an existing AD. Create a few groups for read-write or read-only access. Let's use:
- network-operators: router login permitted, read only
- network-administrators: full admin/config access
AD Configuration
- Create an AD user for freeradius application to bind to LDAP. Let's call it 'freeradius'. Maybe you don't want the password to expire as well.
FreeRadius / Centos Config
- Install freeradius packages on your centos-ey server:
- yum install freeradius freeradius-ldap
- /etc/raddb/modules/ldap:
ldap { server = "ad.yourcompany.com" port = 389 start_tls = yes identity = "CN=freeradius,OU=Applications,DC=ad,DC=yourcompany,DC=com" password = password_goes_here basedn = "DC=ad,DC=yourcompany,DC=com" filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}}))" groupmembership_filter = "(|(&(objectClass=group)(member=%{control:Ldap-UserDn})))" groupmembership_attribute = memberOf edir_account_policy_check=no ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 chase_referrals = yes rebind = yes }
- Modifications to sites-enabled/default:
- In the authorize {} section:
- uncomment 'ldap'
- comment 'files' (which refers to the users plain text file)
- In the authenticate {} section, uncomment:
- In the authorize {} section:
Auth-Type LDAP { ldap }
- in the post-auth {} section add this section to do LDAP group to radius reply item mapping:
if (LDAP-Group == "network-administrators") { update reply { cisco-avpair = "shell:priv-lvl=15", Juniper-Local-User-Name = "superuser" } } elsif (LDAP-Group == "network-operators") { update reply { cisco-avpair = "shell:priv-lvl=1", Juniper-Local-User-Name = "op" } } else { reject }
Router Config
Not going into detail of your router configs, but they will have to be configured to point to your RADIUS server.
On the Juniper side the "op" and "superuser" referenced above will have to map to some classes and users:
system { login { class super-user-local { permissions all; } class operator-local { permissions [ clear network reset trace view ]; } user superuser { uid 2000; class super-user-local; } user op { uid 2001; class operator-local; } } }