I'm trying to set up switch logons for IT staff. Some will get operator (limited, read-only) access, some get manager (full) access. I've got two Active Directory groups that control which access they get.
I've got the ntlm_auth section working with two different instances, one for
each, using the "--require-membership-of" switch to ntlm_auth.
**** modules/ntlm_auth ****
exec ntlm_auth.swcmgr {
wait = yes
program = "/usr/bin/ntlm_auth --request-nt-key --domain= MYDOMAIN
--username=%{User-Name} --password=%{User-Password}
--require-membership-of=MYDOMAIN\\SWITCH-MANAGERS"
}
exec ntlm_auth.swcoper {
wait = yes
program = "/usr/bin/ntlm_auth --request-nt-key --domain= MYDOMAIN
--username=%{User-Name} --password=%{User-Password}
--require-membership-of=MYDOMAIN\\SWITCH-OPERATORS"
}
**** End of file ****
I've also got the following in my users file:
**** users ****
DEFAULT Auth-Type = ntlm_auth.swcmgr, Service-Type == 7,
NAS-Port-Type == 5
Service-Type := 6,
# Fall-Through = Yes
#DEFAULT Auth-Type = ntlm_auth.swcoper, Service-Type == 7,
NAS-Port-Type == 5
# Service-Type := 7
**** End of file ****
And in sites-enabled/default, I've listed these two in the authenticate
section.
With the config above, it'll let managers in with manager access, but not
operators. If I comment out the first DEFAULT line in the users file, and
uncomment the second, it'll let operators in with operator access, but not
managers. But if I uncomment out both, operators get denied access on the
first DEFAULT line, and processing stops. If I uncomment out the
"Fall-Through" line, it appears to only fall-through on success of the first
DEFAULT section, not on failure.
What's the best way to accomplish what I want? I think I'd need to use
unlang somehow, but the sites-enabled/default says unlang should go in
post-auth, and I think I need it in the authenticate section? Or should I
be looking to do it in the modules/ntlm_auth file? Is this too complicated
for unlang, should I be looking at perl or python? Or am I overcomplicating
things? Any pointers would be appreciated.
John H. Moe
Network Support - Hatch IT
HATCH
Tel: +61 (7) 3166 7777
Direct: +61 (7) 3166 7684
Fax: +61 (7) 3368 3754
Mobile: +61 438 772 425
61 Petrie Terrace, Brisbane, Queensland Australia 4000
*****************************
NOTICE - This message from Hatch is intended only for the use of the individual
or entity to which it is addressed and may contain information which is
privileged, confidential or proprietary.
Internet communications cannot be guaranteed to be secure or error-free as
information could be intercepted, corrupted, lost, arrive late or contain
viruses. By communicating with us via e-mail, you accept such risks. When
addressed to our clients, any information, drawings, opinions or advice
(collectively, "information") contained in this e-mail is subject to the terms
and conditions expressed in the governing agreements. Where no such agreement
exists, the recipient shall neither rely upon nor disclose to others, such
information without our written consent. Unless otherwise agreed, we do not
assume any liability with respect to the accuracy or completeness of the
information set out in this e-mail. If you have received this message in
error, please notify us immediately by return e-mail and destroy and delete the
message from your computer.
smime.p7s
Description: S/MIME cryptographic signature
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
