![FreeRadius + Active Directory + Google 身份验证器](https://linux22.com/image/711323/FreeRadius%20%2B%20Active%20Directory%20%2B%20Google%20%E8%BA%AB%E4%BB%BD%E9%AA%8C%E8%AF%81%E5%99%A8.png)
我在 CentOS 7.3 上安装了 FreeRadius 3.0.13,它还安装了 SSSD 1.14.0,用于与我们的 Windows 2012 域控制器通信。我们能够通过 radius 使用 AD 进行身份验证。我们还在此 Radius 服务器上安装了 google 身份验证器。我们能够连接到我们的 openvpn 服务器,并且使用 AD 和 Google 进行身份验证很好,这里没有问题。
然而,我在尝试仅允许特定 AD 组中的用户进行身份验证时遇到了问题。我使用“pam_sss”模块对 AD 进行身份验证。
这是我的“pam.d/radius”配置
#%PAM-1.0
auth requisite pam_google_authenticator.so forward_pass
auth required pam_sss.so use_first_pass
account required pam_nologin.so
account include password-auth
session include password-auth
这是我的“raddb/users”配置
DEFAULT Auth-Type := PAM
#DEFAULT Group == "remoteaccess", Auth-Type := Reject
# Reply-Message = "You are a member of the Correct remoteaccess Group"
DEFAULT Framed-Protocol == PPP
Framed-Protocol = PPP,
Framed-Compression = Van-Jacobson-TCP-IP
DEFAULT Hint == "CSLIP"
Framed-Protocol = SLIP,
Framed-Compression = Van-Jacobson-TCP-IP
这是我的“raddb/default”配置
server default {
listen {
type = auth
ipaddr = *
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 300
}
}
listen {
ipaddr = *
port = 0
type = acct
limit {
idle_timeout = 300
}
}
listen {
type = auth
ipv6addr = :: # any. ::1 == localhost
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 300
}
}
listen {
ipv6addr = ::
port = 0
type = acct
limit {
}
}
authorize {
filter_username
preprocess
chap
mschap
digest
suffix
eap {
ok = return
}
files
-sql
-ldap
expiration
logintime
pap
}
authenticate {
Auth-Type PAP {
pap
}
Auth-Type CHAP {
chap
}
Auth-Type MS-CHAP {
mschap
}
mschap
digest
pam
eap
}
preacct {
preprocess
acct_unique
suffix
files
}
accounting {
detail
unix
-sql
exec
attr_filter.accounting_response
}
session {
}
post-auth {
update {
&reply: += &session-state:
}
-sql
exec
remove_reply_message_if_eap
Post-Auth-Type REJECT {
-sql
attr_filter.access_reject
eap
remove_reply_message_if_eap
}
Post-Auth-Type Challenge {
}
}
pre-proxy {
}
post-proxy {
eap
}
}
这是 raddb/radius 配置
prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = /usr/sbin
logdir = ${localstatedir}/log/radius
raddbdir = ${sysconfdir}/raddb
radacctdir = ${logdir}/radacct
name = radiusd
confdir = ${raddbdir}
modconfdir = ${confdir}/mods-config
certdir = ${confdir}/certs
cadir = ${confdir}/certs
run_dir = ${localstatedir}/run/${name}
db_dir = ${localstatedir}/lib/radiusd
debug_level = 9
libdir = /usr/lib64/freeradius
pidfile = ${run_dir}/${name}.pid
correct_escapes = true
max_request_time = 30
cleanup_delay = 5
max_requests = 16384
hostname_lookups = no
log {
destination = files
colourise = yes
file = ${logdir}/radius.log
syslog_facility = daemon
stripped_names = yes
auth = yes
auth_badpass = yes
auth_goodpass = yes
msg_denied = "You are already logged in - access denied"
}
checkrad = ${sbindir}/checkrad
security {
user = root
group = root
allow_core_dumps = no
max_attributes = 200
reject_delay = 1
status_server = yes
}
proxy_requests = yes
$INCLUDE proxy.conf
$INCLUDE clients.conf
thread pool {
start_servers = 5
max_servers = 32
min_spare_servers = 3
max_spare_servers = 10
max_requests_per_server = 0
auto_limit_acct = no
}
modules {
$INCLUDE mods-enabled/
}
instantiate {
}
policy {
$INCLUDE policy.d/
}
$INCLUDE sites-enabled/
有谁知道如何检查 AD 组并根据用户所在组或不所在组来拒绝吗?
答案1
我们有一个类似的设置,但没有 Google 身份验证。freeradius 中的 AD 组限制可以按如下方式配置:
该users
文件包含:
DEFAULT Ldap-Group != "vpn", Auth-Type := Reject
该modules/ldap
文件包含:
ldap {
server = 127.0.0.1
identity = "cn=ad-freerad,cn=System,dc=kiwi,dc=intern"
password = "SECRET"
basedn = "dc=kiwi,dc=intern"
filter = "(&(objectClass=USER)(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}))"
ldap_connections_number = 5
max_uses = 0
port = 389
timeout = 4
timelimit = 3
net_timeout = 1
chase_referrals = no
rebind = no
tls {
start_tls = no
}
dictionary_mapping = ${confdir}/ldap.attrmap
password_attribute = userPassword
groupname_attribute = cn
groupmembership_filter = "(&(objectclass=GROUP)(member=%{control:Ldap-UserDn}))"
set_auth_type = no
keepalive {
idle = 60
probes = 3
interval = 3
}
}
这确保 radius 使用 ldap 模块检查用户的组,如果用户不是组成员,则请求将被拒绝VPN 安全。