NPS Radius Gaia admin authenication

Durin — Tue, 12 Jan 2021 16:01:15 GMT

Hi,

I am authenticating Gaia web/ssh admins using Windows Server 2019 NPS Radius with MFA.

It works fine, it is possible to login and the MFA is working as well but i have issues with ssh users, it seems they do not get correct permissions.

The gaia config is as follows:

add rba role radius-group-RW domain-type System all-features

add aaa radius-servers priority 1 host ip_radius1 port 1812 secret ***** timeout 15
add aaa radius-servers priority 2 host ip_radius2 port 1812 secret ***** timeout 15
set aaa radius-servers NAS-IP PUBLIC_IP_OF_GW
set aaa radius-servers default-shell /bin/bash
set aaa radius-servers super-user-uid 96

Windows NPS Radius configured according to sk72940 (The NPS path, and also tried the Radius which had some different values.)

Now to the problem, when admin logins with an AD (Radius) account it is not possible to run cphaprob for example.

[Expert@gw1:0]# cphaprob
-bash: cphaprob: command not found
[Expert@gw:0]# clish
gw1> cphaprob
/tmp/.CPprofile.sh: line 1: /opt/CPshrd-R80.30/scripts/cpprofile_functions.sh: Permission denied

gw1> [Expert@gw1:0]#
[Expert@gw1:0]#
[Expert@gw1:0]#
[Expert@gw1:0]# id
uid=96(_nonlocl) gid=100(users) groups=100(users)

Clish commands seem to run fine.

Gateway version is R80.30 Take 219

We have tried many things to overcome this issue, like changing group names etc.

Also changed the superuser id for radius to 0

set aaa radius-servers super-user-uid 0

But it makes no difference.

If i create an local user on the gw and make it member of same group as the radius users should have then it runs without issues.

For what i can understand, the radius user does not simply have permissions to run this command, since it is member of group 100 users.

-rwxr-x--- 1 admin bin 2982 Apr 30 2019 /opt/CPshrd-R80.30/scripts/cpprofile_functions.sh

The webgui seems to work as it should.

Would be grateful for any pointers or assistance here, this is a new setup so it has not worked before.

Thanks, Rickard

Re: NPS Radius Gaia admin authenication

PhoneBoy — Tue, 12 Jan 2021 17:27:50 GMT

I’m not clear what the intended goal is here in terms of permissions.
Do you want the users to be “admin” level or just to be able to run certain commands?

Re: NPS Radius Gaia admin authenication

Durin — Tue, 12 Jan 2021 19:00:34 GMT

Hi,

Yes correct, the users should be able to run all commands. Same as admin user.

Best Regards,Rickard

Re: NPS Radius Gaia admin authenication

PhoneBoy — Wed, 13 Jan 2021 03:40:46 GMT

This topic is discussed here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk72940

Re: NPS Radius Gaia admin authenication

Durin — Wed, 13 Jan 2021 09:48:33 GMT

Found the solution here:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk105575

Thanks for replying

Br, Rickard

topic Re: NPS Radius Gaia admin authenication in Firewall and Security Management

NPS Radius Gaia admin authenication

Re: NPS Radius Gaia admin authenication

Re: NPS Radius Gaia admin authenication

Re: NPS Radius Gaia admin authenication

Re: NPS Radius Gaia admin authenication