AAA на примере FreeRadius

AAA на примере FreeRadius

AAA

Что такое AAA?

Различные способы хранения учетных данных и протоколы проверки.

local LDAP Kerberos RADIUS TACACS+ SSO

RADIUS-server <---> NAS <---> user

freeradius

apt-get install freeradius

NAS:

/etc/freeradius/clients.conf

client 10.13.0.2 {
    ipaddr = 10.13.0.2
    secret = testing123
}

Пользователи:

/etc/freeradius/users

cisco Cleartext-Password := "ciscocisco"

service freeradius stop
freeradius -X

Проверка:

root@model-net-ctrl-1:~# radtest cisco ciscocisco 127.0.0.1 0 testing123
Sending Access-Request of id 118 to 127.0.0.1 port 1812
        User-Name = "cisco"
        User-Password = "ciscocisco"
        NAS-IP-Address = 212.192.64.218
        NAS-Port = 0
        Message-Authenticator = 0x00000000000000000000000000000000
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=118, length=20

Cisco IOS

default config

Начальная конфигурация коммутатора для работы выглядит так

!
service timestamps log datetime msec localtime show-timezone year
!
enable secret 5 $1$eII1$tBNEV9R6Gzy2cr/9rAaxk1
!
username cisco1 secret 5 $1$d08J$pSSW3WfregkPKjYJAWjyX0
no aaa new-model
clock timezone GMT+6 6 0
!
vlan internal allocation policy ascending
!
vlan 88
!
interface range FastEthernet0/1 - 24
 switchport access vlan 88
 switchport mode access
 spanning-tree portfast
!
interface Vlan88
 ip address 212.192.88.150 255.255.255.0
 no shut
!
ip default-gateway 212.192.88.1
!
line vty 0 15
 logging synchronous
 login local
!
ntp server 212.192.64.2

AAA new-model

aaa new-model 
!
radius-server host 212.192.64.174 auth-port 1812 acct-port 1813 timeout 2 retransmit 1 key superciscosecret
!
aaa group server radius RAD-GROUP
 server 212.192.64.174 auth-port 1812 acct-port 1813
!         
aaa authentication login ADMINUSERS group RAD-GROUP local
! new login auth-list “ADMINUSERS” with local fallback
!
aaa authentication enable default enable
! use enable password to enter enable mode in default auth-list
!
!
line vty 0 15
  login authentication ADMINUSERS
!

При выключенном RADIUS-сервере коммутатор после 2 попыток перейдет на локальную аутентификацию. Т.е. без RAIUDS-сервера мы по прежнему можем попасть на коммутатор под локальным пользователем.

freeradius

client switch150 {
    ipaddr = 212.192.88.150
    secret = superciscosecret
}

Диагностика

Со стороны NAS (коммутатора)

term mon
debug radius
test aaa group RAD-GROUP cisco ciscocisco port 1 new-code
un all
term no mon

Со стороны сервера freeradius -X

root@model-net-ctrl-1:/etc# tcpdump "port 1812" -nnn -i eth1 -s 1500 -vvv
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 1500 bytes
11:51:36.275332 IP (tos 0x0, ttl 254, id 3630, offset 0, flags [none], proto UDP (17), length 97)
    212.192.88.150.1645 > 10.13.0.2.1812: [udp sum ok] RADIUS, length: 69
        Access Request (1), id: 0x1b, Authenticator: dfacf1437114f8ced34046c44225b8d8
          Username Attribute (1), length: 7, Value: cisco
            0x0000:  6369 7363 6f
          Password Attribute (2), length: 18, Value:
            0x0000:  137f 8eb9 d766 2216 018f 1af8 5f40 40ba
          NAS Port Attribute (5), length: 6, Value: 2
            0x0000:  0000 0002
          NAS Port ID Attribute (87), length: 6, Value: tty2
            0x0000:  7474 7932
          NAS Port Type Attribute (61), length: 6, Value: Virtual
            0x0000:  0000 0005
          NAS IP Address Attribute (4), length: 6, Value: 212.192.88.150
            0x0000:  d4c0 5896
11:51:36.275649 IP (tos 0x0, ttl 64, id 13226, offset 0, flags [none], proto UDP (17), length 48)
    10.13.0.2.1812 > 212.192.88.150.1645: [bad udp cksum 0x3793 -> 0x8c9c!] RADIUS, length: 20
        Access Accept (2), id: 0x1b, Authenticator: 9930efbeaea37a010f63c6dc8a1c1a13

SSH

!
no ip domain-lookup
!
ip domain-name KOIBAS.PSNRU
!
crypto key generate rsa 
2048
!
ip ssh ver 2
!
line vty 0 15
  transport input ssh
!

Диагностика ssh

На коммутаторе

sh ip ssh

sh ssh

syslog

logging host 10.13.0.2
logging trap debugging
logging on 

/etc/rsyslog.conf

раскомментировать строки

$ModLoad imudp
$UDPServerRun 514

service rsyslog restart

 tail -F /var/log/messages /var/log/debug