FreeRadius+Cisco交換機+Windows AD實現802.1X認證

阿新 • • 發佈：2018-07-31

inpu onf its 配置 add ima using emctl 下一步

（一）概述
本文檔描述了如何設置FreeRadius服務器，以便對windows客戶端網絡用戶透明的對ActiveDirectory進行身份驗證。

1.1、原理：
FrReRADIUS通過基於端口的訪問控制提供身份驗證。只有當認證服務器驗證了證書時，用戶才能連接到網絡。用戶證書通過使用802.1x標準的特殊認證協議來驗證。（FreeRADIUS offers authentication via port based access control. A user can connect to the network only if its credentials have been validated by the authentication server. User credentials are verified by using special authentication protocols which belong to the 802.1X standard.---官方文檔）

如上圖所示，如果用戶憑據已被FRIERADIUS服務器認證，則僅授予工作站的網絡訪問權限。否則，交換機端口將被關閉對所有的網絡流量。RADIUS服務器允許與域控制器聯系以進行用戶身份驗證。雖然交換機端口被關閉，但是工作站可以通過認證協議與RADIUS服務器通信。RADIUS服務器能夠檢查域控制器，如果用戶存在並且密碼是否正確。如果是這種情況，RADIUS服務器告訴交換機打開端口，用戶將訪問網絡。

1.2、所需的環境

CentOS7.4
FreeRADIUS 3.0.17(https://freeradius.org/releases/)
Samba 3.0.x
Openssl
Cisco Switch

Windows7 sp1

（二）、Linux服務器的安裝配置
1、關閉防火墻和selinux

[appuser@FreeRadius2 ~]$ sudo iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 
[appuser@FreeRadius2 ~]$ sudo grep ‘^[a-Z]‘ /etc/selinux/config 
SELINUX=disabled
SELINUXTYPE=targeted

2、編譯安裝freeradius

[appuser@FreeRadius2 ~]# sudo xf freeradius-server-3.0.17.tar.gz
[appuser@FreeRadius2 ~]# cd freeradius-server-3.0.17
[root@FreeRadius2 freeradius-server-3.0.17]# sudo yum install libtalloc-devel -y
[root@FreeRadius2 freeradius-server-3.0.17]#yum install openssl openssl-devel
[appuser@FreeRadius2 freeradius-server-3.0.17]#sudo ./configure
[appuser@FreeRadius2 freeradius-server-3.0.17]# sudo make && make install
[root@FreeRadius2 raddb]# cp /usr/local/sbin/rc.radiusd /etc/init.d/radiused
[root@FreeRadius2 raddb]# /etc/init.d/radiused start
[root@FreeRadius2 raddb]# ps -ef|grep radiusd
root      5529     1  0 17:04 ?        00:00:00 /usr/local/sbin/radiusd
root      5537 26619  0 17:04 pts/2    00:00:00 grep --color=auto radiusd
[root@FreeRadius2 raddb]# /etc/init.d/radiused stop
Stopping FreeRADIUS: radiusd.
[root@FreeRadius2 raddb]# ps -ef|grep radiusd

3、安裝配置samba

    [appuser@FreeRadius2 ~]$ sudo yum install samba samba-client samba-winbind krb5-server
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
Resolving Dependencies
--> Running transaction check
---> Package krb5-server.x86_64 0:1.15.1-19.el7 will be installed
Installed:
  krb5-server.x86_64 0:1.15.1-19.el7  samba.x86_64 0:4.7.1-6.el7  samba-client.x86_64 0:4.7.1-6.el7  samba-winbind.x86_64 0:4.7.1-6.el7 

Dependency Installed:
  avahi-libs.x86_64 0:0.6.31-19.el7             cups-libs.x86_64 1:1.6.3-35.el7         libarchive.x86_64 0:3.1.2-10.el7_2              
  libevent.x86_64 0:2.0.21-4.el7                libldb.x86_64 0:1.2.2-1.el7             libsmbclient.x86_64 0:4.7.1-6.el7               
  libtalloc.x86_64 0:2.1.10-1.el7               libtdb.x86_64 0:1.3.15-1.el7            libtevent.x86_64 0:0.9.33-2.el7                 
  libverto-libevent.x86_64 0:0.2.5-4.el7        libwbclient.x86_64 0:4.7.1-6.el7        pytalloc.x86_64 0:2.1.10-1.el7                  
  samba-client-libs.x86_64 0:4.7.1-6.el7        samba-common.noarch 0:4.7.1-6.el7       samba-common-libs.x86_64 0:4.7.1-6.el7          
  samba-common-tools.x86_64 0:4.7.1-6.el7       samba-libs.x86_64 0:4.7.1-6.el7         samba-winbind-modules.x86_64 0:4.7.1-6.el7      
  words.noarch 0:3.0-22.el7                    

Dependency Updated:
  dbus.x86_64 1:1.10.24-7.el7     dbus-libs.x86_64 1:1.10.24-7.el7 krb5-devel.x86_64 0:1.15.1-19.el7 krb5-libs.x86_64 0:1.15.1-19.el7
  libkadm5.x86_64 0:1.15.1-19.el7

Complete!

3、配置samba服務器並重啟samba服務。
一旦PAP認證測試成功，使用ActiveDirectory的站點的下一步是配置系統以對ActiveDirectory進行用戶身份驗證。明文密碼通過ActiveDirectory不可用，因此我們必須使用SAMBA和ntlm_auth程序。在這個配置中，我們使用ActiveDirectory作為身份驗證Oracle，而不是LDAP數據庫。一旦Samba已經安裝在您的系統上，您應該編輯SMBCONF文件，並將[Global ]部分配置為指向NT服務器，包括主機名和NT域。本文只配置samba配置文件中的[global]部分

[root@FreeRadius2 raddb]# vim /etc/samba/smb.conf

[global]
        workgroup = CORP                  ##指定域的netbios名稱
                security = ads                           ##指定samba的工作模式，和域集成
        winbind use default domain = no
        password server = X.X.X.X           #指定定身份驗證的服務器為域控   
        realm = CORP.BAIDU.COM         #指定AD域名   

[homes]
    comment = Home Directories
    valid users = %S, %D%w%S
    browseable = No
    read only = No
    inherit acls = Yes

[printers]
    comment = All Printers
    path = /var/tmp
    printable = Yes
    create mask = 0600
    browseable = No

[print$]
    comment = Printer Drivers
    path = /var/lib/samba/drivers
    write list = @printadmin root
    force group = @printadmin
    create mask = 0664
    directory mask = 0775

[root@FreeRadius2 raddb]# systemctl start smb
[root@FreeRadius2 raddb]# systemctl status smb
● smb.service - Samba SMB Daemon
   Loaded: loaded (/usr/lib/systemd/system/smb.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2018-07-31 17:16:05 CST; 4s ago
 Main PID: 5587 (smbd)
   Status: "smbd: ready to serve connections..."
   CGroup: /system.slice/smb.service
           ├─5587 /usr/sbin/smbd --foreground --no-process-group
           ├─5589 /usr/sbin/smbd --foreground --no-process-group
           ├─5590 /usr/sbin/smbd --foreground --no-process-group
           └─5591 /usr/sbin/smbd --foreground --no-process-group

4、配置/etc/krb5.conf

[root@FreeRadius ~]# vim  /etc/krb5.conf
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = CORP.BAIDU.COM                         #指定域名
 dns_lookup_realm = false                                  
 dns_lookup_kdc = false

[realms]
CORP.PPDAI.COM = {
  kdc = 10.128.105.170:88                               #指域控為kdc服務器及端口
  admin_server = 10.128.105.170:749                     #指定域控的管理端口
  default_domain = corp.baidu.com
 }

[domain_realm]
 .corp.ppdai.com = CORP.BAIDU.COM
  corp.ppdai.com = CORP.BAIDU.COM

[kdc]
  profile =/var/kerberos/krb5kdc/kdc.conf

[appdefaults]
 pam = {
  debug = false
  ticket_lifetime = 36000
  renew_lifetime = 36000
  forwardable = true
  krb4_convert = false
 }

5、編輯/etc/nsswich.conf，在下列行末添加winbind，其他的不變

[root@FreeRadius ~]# cat /etc/nsswitch.conf
passwd:     files sss winbind
shadow:     files sss winbind
group:      files sss winbind

protocols:  files sss winbind

services:   files sss winbind

netgroup:   files sss winbind

automount:  files sss winbind

6、把改臺服務器添加到域中。如果不加入到域的話，啟動winbind服務會起不來出現報錯。

[root@FreeRadius2 radiusd]# net join -U liqingbiao
Enter liqingbiao‘s password:
Using short domain name -- CORP
Joined ‘FREERADIUS2‘ to dns domain ‘corp.baidu.com‘
No DNS domain configured for freeradius2. Unable to perform DNS Update.
DNS update failed: NT_STATUS_INVALID_PARAMETER

7、啟動smaba和winbind服務。

[root@FreeRadius2 radiusd]# systemctl enable winbind
[root@FreeRadius2 radiusd]# systemctl enable smb
[root@FreeRadius2 radiusd]# systemctl start winbind
[root@FreeRadius2 radiusd]# systemctl start smb
[root@FreeRadius2 radiusd]# systemctl status winbind
● winbind.service - Samba Winbind Daemon
   Loaded: loaded (/usr/lib/systemd/system/winbind.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2018-07-31 17:26:30 CST; 1min 5s ago
 Main PID: 5651 (winbindd)
   Status: "winbindd: ready to serve connections..."
   CGroup: /system.slice/winbind.service
           ├─5651 /usr/sbin/winbindd --foreground --no-process-group
           └─5653 /usr/sbin/winbindd --foreground --no-process-group

8、通過wbinfo進行賬號拉取測試。wbinfo –a user%password

[root@FreeRadius2 appuser]# wbinfo -a it001%123456
plaintext password authentication failed
Could not authenticate user it004%Aa123456 with plaintext password
challenge/response password authentication succeeded     ###成功了
[root@FreeRadius2 appuser]# ntlm_auth --request-nt-key --domain=CORP --username=it001   ###ntlm是windows 域環境下的認證方式
Password: 
NT_STATUS_OK: The operation completed successfully. (0x0)

9、修改/var/lib/samba/winbindd_privileged權限

[root@FreeRadius2 appuser]#usermod –G wbpriv radiusd
[root@FreeRadius2 appuser]#chown –R root.radiusd /var/lib/samba/winbindd_privileged

（三）、FreeRadius的配置
freeradius具體相關的配置如下：

clients.conf
mods-available/mschap
mods-available/eap
users

1、配置clients.conf文件，添加通信客戶端。

[root@FreeRadius2 ~]# vim /usr/local/etc/raddb/clients.conf
client 172.20.19.0/24 {
        secret = test
        showtanme = CE-SW
        }

client 172.20.66.0/24 {
    secret = Aa@@123456
    showtanme = CE-SW
    }

client 172.20.94.0/24 {
        secret = Aa@@123456
        showtanme = CE-SW
        }

2、配置mods-available/mschap文件。編輯/usr/local/etc/raddb/mods-available/mschap文件
[root@FreeRadius2 ~]# vim /usr/local/etc/raddb/mods-available/mschap

   with_ntdomain_hack = yes
   ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{mschap:User-Name}:-00} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00} --domain=%{%{mschap:NT-Domain}:-CORP.BAIDU.COM}"

3、配置mods-available/eap文件，編輯/usr/local/etc/raddb/mods-available/eap文件

[root@FreeRadius2 ~]# vim /usr/local/etc/raddb/mods-available/eap 
default_eap_type = peap.

random_file = /dev/urandom

4、配置/usr/local/etc/raddb/mods-enabled/ntlm_auth文件

[root@FreeRadius2 ~]# vim /usr/local/etc/raddb/mods-enabled/ntlm_auth
exec ntlm_auth {
        wait = yes
        program = "/usr/bin/ntlm_auth --request-nt-key --domain=CORP.PPDAI.COM --username=%{mschap:User-Name} --password=%{User-Password}"

5、編輯/etc/raddb/sites-enabled/default 和/etc/raddb/sites-enabled/inner-tunnel文件

authenticate {        ...        ntlm_auth        ...}

FreeRadius+Cisco交換機+Windows AD實現802.1X認證

inpu onf its 配置 add ima using emctl 下一步（一）概述本文檔描述了如何設置FreeRadius服務器，以便對windows客戶端網絡用戶透明的對ActiveDirectory進行身份驗證。 1.1、原理：FrReRADIUS通過基於端口的

FreeRadius+Cisco交換機+Windows AD實現802.1X認證

FreeRadius+Cisco交換機+Windows AD實現802.1X認證

H3C 交換機和windows NPS結合實現內網802.1X認證

Windows 客戶端802.1x的一些設置

華為AC配置802.1X認證

自學Aruba7.3-Aruba安全認證-802.1x認證（web頁面配置）

淺談802.1X認證

hostapd程式碼分析-完全的802.1X認證過程（radius伺服器）

一個完整的802.1X認證的互動

wifi無線認證,802.1x認證上網方式詳解

FreeRadius + Daloradius + Ubuntu Server 實現的無線802.1x的radius驗證

linux下的freeradius（802.1x）伺服器搭建總結

cisco如果設定802.1X配置過程

兩層交換機上劃分VLAN借三層交換機路由功能實現跨網段訪問(Cisco Packer Tracer 模擬器)

鏈路聚合+STP+埠隔離+802.1x驗證實現互通

freeradius 802.1X EAP-PEAP 認證失敗問題的解決

IEEE 802.1X標準

cisco交換機

不用寫Windows服務實現定時器功能（FluentScheduler ）

WINDOWS7 下 xclient 802.1x 客戶端停止運行的解決辦法

cisco交換機開啟dhcp服務

FreeRadius+Cisco交換機+Windows AD實現802.1X認證

相關推薦