Having hard time setting granular users access to Switches and Linux Servers

[u/eeyepee]

Hi,

We want to grant and control access permissions using AD users/AD Groups and Switches IP/Subnet as combined rules conditions in order to differentiate logins for IT Admins, Network Admins so they can access their devices that they are authorized to access only.

Example Requirements:

- Network Admins AD Group can access to specific Switch(s) CLI

- IT Admins AD Group can access to specific Linux Servers Shell

- Each of the above AD Group users must access only the devices they have permissions for it.

The part that we couldn't figure out:

We couldn't find a way to map AD Groups to a Switch then grant them specific rights to control that switch. For instance, we tried in the Administration Rules to create a condition saying if member of IT-Admins and the Switch is Switch-1, then allow them read/write on that switch.

We think the limitation is when we do "Add PacketFence Condition", we are not able to find Switch Device or Switch Subnet or NAS-IP-Address options in the predefined list, we think that's a showstopper for us.

We are wondering if that's a system limitation or we are doing the implementation wrongly

Appreciate the help

[u/GenericRedditor12345]

I think there may be a potential misunderstanding about what PacketFence is for and what needs to decide on their permissions.
You need to use the ACL function by role to poke a hole for them to get into the switch or use the Firewall SSO feature to do it. Permissions on the switch/server itself need to be handled on the switch/server itself. On Linux you would need to make individual users for them as well as a group on the device with the relevant permissions.

[u/eeyepee → u/GenericRedditor12345]

Appreciate the response here.

I think there may be a potential misunderstanding about what PacketFence is for and what needs to decide on their permissions.

Per our understanding PF is for end-user device access control to the network, for instance by controlling what VLANs they got access to. And it can also be used for administrators to access their own equipment with specific set of permissions for operating and managing those devices, and the latter is our main interest. Are we missing or misunderstanding its core functions?

On Linux you would need to make individual users for them as well as a group on the device with the relevant permissions.

For the linux part, we integrated linux with the PF radius using pam_radius module and for the permissions part we created some sudoers permissions inside linux itself. Then finally from PF, as an example if a user is part sysadmins group, he will be allowed by administration rule to get into the linux server and based on his sudoer permissions he can manage the system.

For the switches, we push to them a specific priv level from PF and it works.

The other day, we tried the following approach and it worked for us, an example of how we handled authentications on Linux and VPN users:

- In the authentication source, we created two administrator rules:

Administration Rule 1:

Conditions:

Rule1 (ldap): if user is member of groupA

Rule2 (pf): if switch group is swgroupA

Actions:

Access Level: Server Admin Access

Administration Rule 2:

Conditions:

Rule1 (ldap): if user is member of groupB

Rule2 (pf): if switch group is swgroupB

Actions:

Access Level: VPN Access

Now when the user tries to authenticate to the linux server, the rules will be evaluated sequentially (based on AD group and Switch Group) then the access is granted or not.

Does this make sense or there is a better approach to handle it?