我一直在做很多關於ssh(openssh)和radius的研究。SSH + Radius + LDAP
我想要做什麼:
SSH到設備與存儲在任何一個RADIUS服務器或LDAP存儲的憑據(用戶名和密碼)。我一直在網上閱讀,有些人指出在你的radius服務器的後臺運行ldap服務器。這將會起作用,但只有在本地機器中找到用戶時纔會起作用。
問題: 有沒有辦法讓我ssh(或telnet)通過包含憑據的radius服務器登錄到我的設備?如果沒有,客戶端(我試圖連接的計算機)的方式是獲取更新的憑證列表,並將其從中央位置本地存儲(無論是半徑服務器還是sql數據庫等)。
我已經能夠通過半徑,但只能在本地帳戶連接,但例如,如果我嘗試與本地不存在的帳戶連接(客戶端明智)我得到「不正確」
下面是半徑輸出: 代碼:
rad_recv: Access-Request packet from host 192.168.4.1 port 5058, id=219, length=85 User-Name = "klopez"
User-Password = "\010\n\r\177INCORRECT"
NAS-Identifier = "sshd"
NAS-Port = 4033
NAS-Port-Type = Virtual
Service-Type = Authenticate-Only
Calling-Station-Id = "192.168.4.200"
代碼:
[ldap] performing user authorization for klopez[ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details
[ldap] ... expanding second conditional
[ldap] expand: %{User-Name} -> klopez
[ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=klopez)
[ldap] expand: dc=lab,dc=local -> dc=lab,dc=local
[ldap] ldap_get_conn: Checking Id: 0
[ldap] ldap_get_conn: Got Id: 0
[ldap] performing search in dc=lab,dc=local, with filter (uid=klopez)
[ldap] No default NMAS login sequence
[ldap] looking for check items in directory...
[ldap] userPassword -> Cleartext-Password == "somepass"
[ldap] userPassword -> Password-With-Header == "somepass"
[ldap] looking for reply items in directory...
[ldap] user klopez authorized to use remote access
[ldap] ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] Config already contains "known good" password. Ignoring Password-With-Header
++[pap] returns updated
Found Auth-Type = PAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group PAP {...}
[pap] login attempt with password "? INCORRECT"
[pap] Using clear text password "somepass"
[pap] Passwords don't match
++[pap] returns reject
Failed to authenticate the user.
WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS!
Using Post-Auth-Type Reject
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> klopez
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 3 for 1 seconds
我也有安裝pam_radius,其工作(可在登錄本地存在的帳戶)。雖然我讀了這一點,不知道這是不是100%準確:
http://freeradius.1045715.n5.nabble.com/SSH-authendication-with-radius-server-fails-if-the-user-does-not-exist-in-radius-client-td2784316.html 和 http://fhf.org/archives/713
TL:DR: 我需要ssh到一臺機器,沒有一個用戶/本地通和該組合將被遠程存儲,例如radius服務器或ldap。
請告知
P.S.
該解決方案最好使用radius服務器或ldap,但不是必需的。如果有替代品,請告知。
感謝,
凱文