码迷,mobileinhere.cn
首页 > windows程序 > 详细

freeradius+cisco交换机+windows ad实现802.1x认证

时间:2018-07-31 19:34:38      阅读:10      评论:0      收藏:0      [点我收藏+]

标签:sed   init   red   特殊   emc   cisc   通过   认证   客户端   

(一)概述
本文档描述了如何设置freeradius服务器,以便对windows客户端网络用户透明的对activedirectory进行身份验证。

1.1、原理:
frreradius通过基于端口的访问控制提供身份验证。只有当认证服务器验证了证书时,用户才能连接到网络。用户证书通过使用802.1x标准的特殊认证协议来验证。(freeradius offers authentication via port based access control. a user can connect to the network only if its credentials have been validated by the authentication server. user credentials are verified by using special authentication protocols which belong to the 802.1x standard.---官方文档)
技术分享图片

如上图所示,如果用户凭据已被frieradius服务器认证,则仅授予工作站的网络访问权限。否则,交换机端口将被关闭对所有的网络流量。radius服务器允许与域控制器联系以进行用户身份验证。虽然交换机端口被关闭,但是工作站可以通过认证协议与radius服务器通信。radius服务器能够检查域控制器,如果用户存在并且密码是否正确。如果是这种情况,radius服务器告诉交换机打开端口,用户将访问网络。

1.2、所需的环境

(二)、linux服务器的安装配置
1、关闭防火墙和selinux

[[email protected] ~]$ sudo iptables -l -n
chain input (policy accept)
target     prot opt source               destination         

chain forward (policy accept)
target     prot opt source               destination         

chain output (policy accept)
target     prot opt source               destination 
[[email protected] ~]$ sudo grep ‘^[a-z]‘ /etc/selinux/config 
selinux=disabled
selinuxtype=targeted 
2、编译安装freeradius
[[email protected] ~]# sudo xf freeradius-server-3.0.17.tar.gz
[[email protected] ~]# cd freeradius-server-3.0.17
[[email protected] freeradius-server-3.0.17]# sudo yum install libtalloc-devel -y
[[email protected] freeradius-server-3.0.17]#yum install openssl openssl-devel
[[email protected] freeradius-server-3.0.17]#sudo ./configure
[[email protected] freeradius-server-3.0.17]# sudo make && make install
[[email protected] raddb]# cp /usr/local/sbin/rc.radiusd /etc/init.d/radiused
[[email protected] raddb]# /etc/init.d/radiused start
[[email protected] raddb]# ps -ef|grep radiusd
root      5529     1  0 17:04 ?        00:00:00 /usr/local/sbin/radiusd
root      5537 26619  0 17:04 pts/2    00:00:00 grep --color=auto radiusd
[[email protected] raddb]# /etc/init.d/radiused stop
stopping freeradius: radiusd.
[[email protected] raddb]# ps -ef|grep radiusd

3、安装配置samba

    [[email protected] ~]$ sudo yum install samba samba-client samba-winbind krb5-server
loaded plugins: fastestmirror
loading mirror speeds from cached hostfile
resolving dependencies
--> running transaction check
---> package krb5-server.x86_64 0:1.15.1-19.el7 will be installed
installed:
  krb5-server.x86_64 0:1.15.1-19.el7  samba.x86_64 0:4.7.1-6.el7  samba-client.x86_64 0:4.7.1-6.el7  samba-winbind.x86_64 0:4.7.1-6.el7 

dependency installed:
  avahi-libs.x86_64 0:0.6.31-19.el7             cups-libs.x86_64 1:1.6.3-35.el7         libarchive.x86_64 0:3.1.2-10.el7_2              
  libevent.x86_64 0:2.0.21-4.el7                libldb.x86_64 0:1.2.2-1.el7             libsmbclient.x86_64 0:4.7.1-6.el7               
  libtalloc.x86_64 0:2.1.10-1.el7               libtdb.x86_64 0:1.3.15-1.el7            libtevent.x86_64 0:0.9.33-2.el7                 
  libverto-libevent.x86_64 0:0.2.5-4.el7        libwbclient.x86_64 0:4.7.1-6.el7        pytalloc.x86_64 0:2.1.10-1.el7                  
  samba-client-libs.x86_64 0:4.7.1-6.el7        samba-common.noarch 0:4.7.1-6.el7       samba-common-libs.x86_64 0:4.7.1-6.el7          
  samba-common-tools.x86_64 0:4.7.1-6.el7       samba-libs.x86_64 0:4.7.1-6.el7         samba-winbind-modules.x86_64 0:4.7.1-6.el7      
  words.noarch 0:3.0-22.el7                    

dependency updated:
  dbus.x86_64 1:1.10.24-7.el7     dbus-libs.x86_64 1:1.10.24-7.el7 krb5-devel.x86_64 0:1.15.1-19.el7 krb5-libs.x86_64 0:1.15.1-19.el7
  libkadm5.x86_64 0:1.15.1-19.el7

complete!

3、配置samba服务器并重启samba服务。
一旦pap认证测试成功,使用activedirectory的站点的下一步是配置系统以对activedirectory进行用户身份验证。明文密码通过activedirectory不可用,因此我们必须使用samba和ntlm_auth程序。在这个配置中,我们使用activedirectory作为身份验证oracle,而不是ldap数据库。一旦samba已经安装在您的系统上,您应该编辑smbconf文件,并将[global ]部分配置为指向nt服务器,包括主机名和nt域。本文只配置samba配置文件中的[global]部分

[[email protected] raddb]# vim /etc/samba/smb.conf

[global]
        workgroup = corp                  ##指定域的netbios名称
                security = ads                           ##指定samba的工作模式,和域集成
        winbind use default domain = no
        password server = x.x.x.x           #指定定身份验证的服务器为域控   
        realm = corp.baidu.com         #指定ad域名   

[homes]
    comment = home directories
    valid users = %s, %d%w%s
    browseable = no
    read only = no
    inherit acls = yes

[printers]
    comment = all printers
    path = /var/tmp
    printable = yes
    create mask = 0600
    browseable = no

[print$]
    comment = printer drivers
    path = /var/lib/samba/drivers
    write list = @printadmin root
    force group = @printadmin
    create mask = 0664
    directory mask = 0775

[[email protected] raddb]# systemctl start smb
[[email protected] raddb]# systemctl status smb
● smb.service - samba smb daemon
   loaded: loaded (/usr/lib/systemd/system/smb.service; enabled; vendor preset: disabled)
   active: active (running) since tue 2018-07-31 17:16:05 cst; 4s ago
 main pid: 5587 (smbd)
   status: "smbd: ready to serve connections..."
   cgroup: /system.slice/smb.service
           ├─5587 /usr/sbin/smbd --foreground --no-process-group
           ├─5589 /usr/sbin/smbd --foreground --no-process-group
           ├─5590 /usr/sbin/smbd --foreground --no-process-group
           └─5591 /usr/sbin/smbd --foreground --no-process-group

4、配置/etc/krb5.conf

[[email protected] ~]# vim  /etc/krb5.conf
[logging]
 default = file:/var/log/krb5libs.log
 kdc = file:/var/log/krb5kdc.log
 admin_server = file:/var/log/kadmind.log

[libdefaults]
 default_realm = corp.baidu.com                         #指定域名
 dns_lookup_realm = false                                  
 dns_lookup_kdc = false

[realms]
corp.ppdai.com = {
  kdc = 10.128.105.170:88                               #指域控为kdc服务器及端口
  admin_server = 10.128.105.170:749                     #指定域控的管理端口
  default_domain = corp.baidu.com
 }

[domain_realm]
 .corp.ppdai.com = corp.baidu.com
  corp.ppdai.com = corp.baidu.com

[kdc]
  profile =/var/kerberos/krb5kdc/kdc.conf

[appdefaults]
 pam = {
  debug = false
  ticket_lifetime = 36000
  renew_lifetime = 36000
  forwardable = true
  krb4_convert = false
 }

5、编辑/etc/nsswich.conf,在下列行末添加winbind,其他的不变

[[email protected] ~]# cat /etc/nsswitch.conf
passwd:     files sss winbind
shadow:     files sss winbind
group:      files sss winbind

protocols:  files sss winbind

services:   files sss winbind

netgroup:   files sss winbind

automount:  files sss winbind

6、把改台服务器添加到域中。如果不加入到域的话,启动winbind服务会起不来出现报错。

[[email protected] radiusd]# net join -u liqingbiao
enter liqingbiao‘s password:
using short domain name -- corp
joined ‘freeradius2‘ to dns domain ‘corp.baidu.com‘
no dns domain configured for freeradius2. unable to perform dns update.
dns update failed: nt_status_invalid_parameter

7、启动smaba和winbind服务。

[[email protected] radiusd]# systemctl enable winbind
[[email protected] radiusd]# systemctl enable smb
[[email protected] radiusd]# systemctl start winbind
[[email protected] radiusd]# systemctl start smb
[[email protected] radiusd]# systemctl status winbind
● winbind.service - samba winbind daemon
   loaded: loaded (/usr/lib/systemd/system/winbind.service; enabled; vendor preset: disabled)
   active: active (running) since tue 2018-07-31 17:26:30 cst; 1min 5s ago
 main pid: 5651 (winbindd)
   status: "winbindd: ready to serve connections..."
   cgroup: /system.slice/winbind.service
           ├─5651 /usr/sbin/winbindd --foreground --no-process-group
           └─5653 /usr/sbin/winbindd --foreground --no-process-group

8、通过wbinfo进行账号拉取测试。wbinfo ╟a user%password

[[email protected] appuser]# wbinfo -a it001%123456
plaintext password authentication failed
could not authenticate user it004%aa123456 with plaintext password
challenge/response password authentication succeeded     ###成功了
[[email protected] appuser]# ntlm_auth --request-nt-key --domain=corp --username=it001   ###ntlm是windows 域环境下的认证方式
password: 
nt_status_ok: the operation completed successfully. (0x0)

9、修改/var/lib/samba/winbindd_privileged权限

[[email protected] appuser]#usermod ╟g wbpriv radiusd
[[email protected] appuser]#chown ╟r root.radiusd /var/lib/samba/winbindd_privileged

(三)、freeradius的配置
freeradius具体相关的配置如下:

  • clients.conf
  • mods-available/mschap
  • mods-available/eap
  • users

1、配置clients.conf文件,添加通信客户端。

[[email protected] ~]# vim /usr/local/etc/raddb/clients.conf
client 172.20.19.0/24 {
        secret = test
        showtanme = ce-sw
        }

client 172.20.66.0/24 {
    secret = [email protected]@123456
    showtanme = ce-sw
    }

client 172.20.94.0/24 {
        secret = [email protected]@123456
        showtanme = ce-sw
        }

2、配置mods-available/mschap文件。编辑/usr/local/etc/raddb/mods-available/mschap文件
[[email protected] ~]# vim /usr/local/etc/raddb/mods-available/mschap

   with_ntdomain_hack = yes
   ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{mschap:user-name}:-00} --challenge=%{%{mschap:challenge}:-00} --nt-response=%{%{mschap:nt-response}:-00} --domain=%{%{mschap:nt-domain}:-corp.baidu.com}"

3、配置mods-available/eap文件,编辑/usr/local/etc/raddb/mods-available/eap文件

[[email protected] ~]# vim /usr/local/etc/raddb/mods-available/eap 
default_eap_type = peap.

random_file = /dev/urandom

4、配置/usr/local/etc/raddb/mods-enabled/ntlm_auth文件

[[email protected] ~]# vim /usr/local/etc/raddb/mods-enabled/ntlm_auth
exec ntlm_auth {
        wait = yes
        program = "/usr/bin/ntlm_auth --request-nt-key --domain=corp.ppdai.com --username=%{mschap:user-name} --password=%{user-password}"

5、编辑/etc/raddb/sites-enabled/default 和/etc/raddb/sites-enabled/inner-tunnel文件

authenticate {        ...        ntlm_auth        ...}

freeradius+cisco交换机+windows ad实现802.1x认证

标签:sed   init   red   特殊   emc   cisc   通过   认证   客户端   

原文地址:blog.51cto.com/liqingbiao/2152850

(0)
(0)
   
举报
评论 一句话评论(0
0条  
登录后才能评论!
2014 mobileinhere.cn 版权所有 京icp备13008772号-2
华人娱乐注册