Freeradius + Authenticator + Google身份验证器

Question

我一直试图让VPN用户使用2FA (Google身份验证器)进行身份验证。目前我有思科ISE，FreeRadius服务器，Active Directory。我想实现的是，当用户连接到VPN (Cisco ISE)时，服务器从Radius服务器请求用户，然后Radius服务器从Active对用户进行身份验证。如果用户身份验证成功，则FreeRadius服务器必须向用户请求OTP。我的配置是：/etc/raddb/sites-enabled/default

server default {
    listen {
        type = auth
        ipaddr = 1.1.1.1
        port = 0
        limit {
            max_connections = 16
            lifetime = 0
            idle_timeout = 30
        }
    }
    listen {
        ipaddr = *
        port = 0
        type = acct
    }
    authorize {
        filter_username
        preprocess
        chap
        mschap
        digest
        suffix
        eap {
            ok = return
        }
        files
        -sql
        ldap
        if ((ok || updated) && User-Password && !control:Auth-Type){
            update {
                control:Auth-Type := ldap
            }
        }
        expiration
        logintime
        pap
    }

    authenticate {
        Auth-Type PAP {
            pap
        }
        Auth-Type CHAP {
            chap
        }
        Auth-Type MS-CHAP {
            mschap
        }
        mschap
        digest
        Auth-Type LDAP {
            ldap
        }
        eap
    }
    preacct {
        preprocess
        acct_unique
        suffix
        files
    }
    accounting {
        detail
        unix
        -sql
        exec
        attr_filter.accounting_response
    }
    session {
    }
    post-auth {
        if (Google-Password) {
            update request {
                pam
            }
        }
        else {
            update reply {
                &Google-Password = "%{Google-Password}"
            }
        }
        update {
            &reply: += &session-state:
        }
        -sql
        exec
        remove_reply_message_if_eap
        Post-Auth-Type REJECT {
            -sql
            attr_filter.access_reject
            eap
            remove_reply_message_if_eap
        }
        Post-Auth-Type Challenge {
        }
    }
    pre-proxy {
    }
    post-proxy {
        eap
    }
}

/etc/raddb/clients.conf

client CISCO_ISE {
        ipaddr = 1.1.1.2
        proto = *
        secret = testing123
        require_message_authenticator = no
        nas_type         = other
        limit {
                max_connections = 16
                lifetime = 0
                idle_timeout = 30
        }
}

/etc/raddb/mods-config/files/authorize

DEFAULT Framed-Protocol == PPP
    Framed-Protocol = PPP,
    Framed-Compression = Van-Jacobson-TCP-IP

DEFAULT Hint == "CSLIP"
    Framed-Protocol = SLIP,
    Framed-Compression = Van-Jacobson-TCP-IP

DEFAULT Hint == "SLIP"
    Framed-Protocol = SLIP

/etc/pam.d/radiusd

auth            requisite       pam_google_authenticator.so forward_pass

使用此配置，FreeRadius服务器请求用户名和密码，但在广告认证后，服务器不需要一次密码

Answer 1

解决了这个问题。对于那些正在配置精确设置的人，您需要使用与会话或cookie相同的state attribute。如果请求有state attribute，那么将身份验证方法更改为PAM，这将检查令牌。否则，如果请求没有state attribute，那么第一次请求就需要通过Active Directory进行身份验证。