With freeradius and PEAP-MSCHAP, how does one limit connectivity to a single group?

Question

I feel like jumping up and down after I got FreeRadius, samba winbind, XCA w/ ECDSA certs, Active Directory, and Ubiquiti Unifi all talking together.

Next problem, any valid account in ActiveDirectory will currently authenticate. How do I limit this to the members of a specific AD group?

One terrible way I had thought of was in in the post-auth module executing a bash script that does a quick LDAP search. Could anything bad happen from this?

EDIT

Here's a guide to getting it all to work! https://gist.github.com/exabrial/368c279aad65cefd8c5f

You know that Windows includes its own RADIUS server, right? — Michael Hampton, Nov 24 '15 at 23:06
It has limited functionality, which is why many people use open source solutions. — Arran Cudbard-Bell, Nov 24 '15 at 23:45
Yes, I'm well aware. I'm not going to have a system that powers our wireless rely on Windows however... — Jonathan S. Fisher, Nov 25 '15 at 00:20

Arran Cudbard-Bell · Accepted Answer · 2021-09-09T14:31:01.940

3

For now, you need to use rlm_ldap (which will be considerably faster than a bash script). We have discussed exposing winbind's APIs for group lookups, but you'd need to be using Samba 3.2.1 and a build of FreeRADIUS v3.1.x to take advantage of any features that were developed.

I'll leave you to look through (and complete) mods-available/ldap as the config file is pretty well documented. After you have it customised to your LDAP server, create a symlink from mods-available/ldap to mods-enabled/ldap to enable the module.

To perform group lookups you need to compare the LDAP-Group attribute with a value, and then make the decision to reject the user.

Something like:

if (LDAP-Group != 'my_group) {
    reject
}

...in the inner tunnel virtual server would work.

edited Sep 09 '21 at 14:31

answered Nov 24 '15 at 23:50

Arran Cudbard-Bell

1,514
1
9
18

Brilliant! I actually just ended up using the searchFilter instead: `filter = "(&(sAMAccountName={0})(memberOf:1.2.840.113556.1.4.1941:=CN=wireless_corp,OU=Networks,OU=Groups,DC=x,DC=x,DC=x,DC=com))"` – Jonathan S. Fisher Nov 25 '15 at 00:29
That works too! :) – Arran Cudbard-Bell Nov 25 '15 at 04:21
I don't know if this is simply unclear from the answer, but an `if` cannot be placed inside of a module. – DustWolf Sep 09 '21 at 07:12
Which is why the bottom of the answer explicitly states that it should be place in a virtual server. – Arran Cudbard-Bell Sep 09 '21 at 14:28

With freeradius and PEAP-MSCHAP, how does one limit connectivity to a single group?

EDIT

1 Answers1