I'm trying to set up switch logons for IT staff. Some will get operator (limited, read-only) access, some get manager (full) access. I've got two Active Directory groups that control which access they get.
I've got the ntlm_auth section working with two different instances, one for each, using the "--require-membership-of" switch to ntlm_auth. **** modules/ntlm_auth **** exec ntlm_auth.swcmgr { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain= MYDOMAIN --username=%{User-Name} --password=%{User-Password} --require-membership-of=MYDOMAIN\\SWITCH-MANAGERS" } exec ntlm_auth.swcoper { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain= MYDOMAIN --username=%{User-Name} --password=%{User-Password} --require-membership-of=MYDOMAIN\\SWITCH-OPERATORS" } **** End of file **** I've also got the following in my users file: **** users **** DEFAULT Auth-Type = ntlm_auth.swcmgr, Service-Type == 7, NAS-Port-Type == 5 Service-Type := 6, # Fall-Through = Yes #DEFAULT Auth-Type = ntlm_auth.swcoper, Service-Type == 7, NAS-Port-Type == 5 # Service-Type := 7 **** End of file **** And in sites-enabled/default, I've listed these two in the authenticate section. With the config above, it'll let managers in with manager access, but not operators. If I comment out the first DEFAULT line in the users file, and uncomment the second, it'll let operators in with operator access, but not managers. But if I uncomment out both, operators get denied access on the first DEFAULT line, and processing stops. If I uncomment out the "Fall-Through" line, it appears to only fall-through on success of the first DEFAULT section, not on failure. What's the best way to accomplish what I want? I think I'd need to use unlang somehow, but the sites-enabled/default says unlang should go in post-auth, and I think I need it in the authenticate section? Or should I be looking to do it in the modules/ntlm_auth file? Is this too complicated for unlang, should I be looking at perl or python? Or am I overcomplicating things? Any pointers would be appreciated. John H. Moe Network Support - Hatch IT HATCH Tel: +61 (7) 3166 7777 Direct: +61 (7) 3166 7684 Fax: +61 (7) 3368 3754 Mobile: +61 438 772 425 61 Petrie Terrace, Brisbane, Queensland Australia 4000 ***************************** NOTICE - This message from Hatch is intended only for the use of the individual or entity to which it is addressed and may contain information which is privileged, confidential or proprietary. Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, arrive late or contain viruses. By communicating with us via e-mail, you accept such risks. When addressed to our clients, any information, drawings, opinions or advice (collectively, "information") contained in this e-mail is subject to the terms and conditions expressed in the governing agreements. Where no such agreement exists, the recipient shall neither rely upon nor disclose to others, such information without our written consent. Unless otherwise agreed, we do not assume any liability with respect to the accuracy or completeness of the information set out in this e-mail. If you have received this message in error, please notify us immediately by return e-mail and destroy and delete the message from your computer.
smime.p7s
Description: S/MIME cryptographic signature
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html