User Tools
radius_аутентификация_в_microsoft_ad
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
radius_аутентификация_в_microsoft_ad [2013/10/09 16:42] val [Win2008] |
radius_аутентификация_в_microsoft_ad [2013/12/15 07:27] (current) val |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== RADIUS аутентификация в Microsoft AD ====== | ====== RADIUS аутентификация в Microsoft AD ====== | ||
| - | ===== Добавление RADIUS интерфейса к AD ===== | + | ===== Win2008 ===== |
| - | ==== Win2008 ==== | + | ==== Установка и настройка ==== |
| - | === Установка и настройка === | + | * Using Windows 2008 for RADIUS Authentification ([[http://www.fatofthelan.com/technical/using-windows-2008-for-radius-authentication/]]) |
| - | + | ||
| - | [[http://www.fatofthelan.com/technical/using-windows-2008-for-radius-authentication/]] | + | |
| <code> | <code> | ||
| Server Manager -> Roles -> | Server Manager -> Roles -> | ||
| Add Roles -> Network Polices and Access Services -> Network Policy Server | Add Roles -> Network Polices and Access Services -> Network Policy Server | ||
| - | Network Polices and Access Services -> NPS(local) -> | + | Network Polices and Access Services -> NPS(local) -> Register server in Active Directory |
| - | Register server in Active Directory | + | |
| Radius Clients and Servers -> new | Radius Clients and Servers -> new | ||
| - | Polices -> Network Polices -> new | + | ... |
| - | Plicy Name: my policy | + | |
| - | Conditions: Windows Group -> Dimain Users | + | |
| - | Configure Authentifications Methods -> Unencrypted Authentificatios (PAP, SPAP) | + | |
| </code> | </code> | ||
| - | === Управление атрибутами === | + | ==== Аутентификация Cisco login ==== |
| - | + | ||
| - | [[http://technet.microsoft.com/en-us/library/cc731611(v=ws.10).aspx]] | + | |
| <code> | <code> | ||
| Server Manager -> Roles -> | Server Manager -> Roles -> | ||
| Network Polices and Access Services -> NPS(local) -> | Network Polices and Access Services -> NPS(local) -> | ||
| - | Polices -> Network Polices -> my policy -> Propeties -> Settings | + | Polices -> Network Polices -> policy cisco admin -> Propeties |
| - | </code> | + | Constraints -> |
| - | + | Configure Authentifications Methods -> Unencrypted Authentificatios (PAP, SPAP) | |
| - | ==== Win2003 ==== | + | Settings -> |
| + | Standart -> Service-Type = NAS-Prompt | ||
| + | </code> | ||
| - | * Add/Remove Programm -> Windows Components -> Networking services/Internet Authenticatin Service (IAS) | + | ==== Авторизация Cisco exec ==== |
| - | * Add peer to IAS (intgate) | + | |
| - | * Remote Access Polices -> Connection to other access server -> Properties -> Edit Profile -> Authentication | + | * Configure a Custom VSA ([[http://technet.microsoft.com/en-us/library/cc731611.aspx]]) |
| - | * Check Unencrypted authentication (PAP, SPAP) | + | * Аутентификация на сетевых устройствах CISCO средствами Active Directory ([[http://habrahabr.ru/post/135419/]]) |
| - | * Permit DialIn for user user | + | |
| - | ===== Тестирование RADIUS интерфейса к AD ===== | ||
| <code> | <code> | ||
| - | gate# radtest user1 'Pa$$w0rd1' server 1 'testing123' | + | Server Manager -> Roles -> |
| - | </code> | + | Network Polices and Access Services -> NPS(local) -> |
| + | Polices -> Network Polices -> policy cisco admin -> Propeties | ||
| + | Constraints -> | ||
| + | Configure Authentifications Methods -> Unencrypted Authentificatios (PAP, SPAP) | ||
| + | Settings -> | ||
| + | Standart -> Service-Type = NAS-Prompt | ||
| + | Vendor Specific -> Cisco-AVPair = shell:priv-lvl=15 | ||
| + | </code> | ||
| + | |||
| + | ==== Аутентификация 802.1x (PEAP) ==== | ||
| - | ===== Нестройка библиотеки pam radius для сервиса ssh ===== | + | * При использовании PEAP в XSupplicant необходимо в поле "Other Identity" указать имя пользователя |
| - | ==== FreeBSD ==== | ||
| <code> | <code> | ||
| - | [gate:~] # cat /etc/radius.conf | + | Server Manager -> Roles -> |
| - | </code><code> | + | Add Roles -> Active Directory Certificate Services |
| - | auth server testing123 3 | + | ... Web Enrollment ... |
| - | </code><code> | + | |
| - | [gate:~] # cat /etc/pam.d/system | + | Server Manager -> Roles -> |
| - | </code><code> | + | Network Polices and Access Services -> NPS(local) -> |
| - | ... | + | Polices -> Network Polices -> new |
| - | auth sufficient pam_radius.so no_warn try_first_pass | + | Plicy Name: policy 802.1x |
| - | auth required pam_unix.so no_warn try_first_pass | + | Conditions: Windows Group -> Domain Users |
| - | ... | + | Configure Authentifications Methods -> Add -> Microsoft...(PEAP) |
| </code> | </code> | ||
| - | ==== Ubuntu ==== | + | |
| - | <code> | + | ===== Win2003 ===== |
| - | root@gate:~# apt-get install libpam-radius-auth | + | |
| - | root@gate:~# cat /etc/pam_radius_auth.conf | + | <code> |
| - | </code><code> | + | Add/Remove Programm -> Windows Components -> Networking services/Internet Authenticatin Service (IAS) |
| - | server testing123 3 | + | Add peer to IAS (intgate) |
| - | </code><code> | + | Remote Access Polices -> Connection to other access server -> Properties -> Edit Profile -> Authentication |
| - | root@gate:~# cat /etc/pam.d/login | + | Check Unencrypted authentication (PAP, SPAP) |
| - | </code><code> | + | Permit DialIn for user user |
| - | ... | + | |
| - | auth sufficient pam_radius_auth.so | + | |
| - | # Standard Un*x authentication. | + | |
| - | ... | + | |
| </code> | </code> | ||
radius_аутентификация_в_microsoft_ad.1381322525.txt.gz · Last modified: 2013/10/09 16:42 by val
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
