FreeNAC Installation Guide

There are three key documents available on http://FreeNAC.net/en/community, the User's, Technical and Installation Guide. FreeNAC administrators will need to read all three. Each is divided into several subpages, if you wish to see it all on one page, click the "Printer-friendly version" link below.

This document describes how to get FreeNAC installed.

A nice, complete step-by-step installation guide for FreeNAC v2.1 and Suse v10 has also been contributed in Word format, see http://opennac.svn.sourceforge.net/viewvc/*checkout*/opennac/branches/2.... . It it limited to the older v2.1 though, and Suse specific.

This document aims to bring similar information, more uptodate.

Contents

 

1. Requirements

To run FreeNAC, you'll need

FreeNAC server hardware requirements

Example: a site running with ~2'000 active end-devices. The server is rarely loaded (CPU or I/O). The slowest part is the Windows GUI with its complex SQL queries - not the VMPS back-end.

Its recommended to have at least 2, and perhaps 3 servers. If you are used to Virtual Machines, do the Master as a VM, and one or more replicas as 'real' machines. Point the switches at the replicas, and use the master for serving GUI requests, scanning and polling switches/routers and processing syslogs.

By doing the master as a VM, snapshots can be used before system upgrades, and roll backs are easier.

2. Quick install using a Virtual Machine (VM)

Introduction

To get FreeNAC up and running, either a physical machine with GNU/Linux and FreeNAC will have to be installed, or the Linux VM downloaded. This section describes the latter approach.

FreeNAC does not run on windows.

In order to get you started quickly with FreeNAC, we have built a Virtual Appliance with Linux, the modules needed, and FreeNAC installed in a 'demo mode'.

You can download the virtual machine, and start it within VMware Workstation or the free VMware Player or Server .

There are two datasets included with the VM: "nacdemo" contains an example that should help to understand the GUI and what information freeNAC stores, whereas "opennac" is an empty dataset ready for productive use.

Installing the VM

  1. Download the file FreeNAC_VM_2.2_RC1.zip (~1.07 GB.
  2. Uncompress it into a folder where your VMs are normally stored
  3. The VM is configured to use "NAT". Set "bridged mode" if the VM is not just to be used as a demo (visible only to your PC with the windows GUI), but should be visible to the network.
  4. Start the VM, ignore the error "ethx interface could not be set up", login as root:freenac (this should fix the previous error).
  5. The VM will try to get an IP address via DHCP, which you can see with 'ifconfig -a'

Optional changes to the Linux VM:

  1. If you need to configure a static IP address or change the network settings, execute 'yast network' (Suse) or 'vi /etc/network/interfaces (Ubuntu).
  2. The keyboard layout in the VM is Swiss German, to set it to your preference,
    Suse: YaST -> Hardware -> Keyboard Settings .
    Ubuntu: to do
  3. Timezone
    Suse: to enable the Europe->Zurich zone ...
    cp /etc/localtime /etc/localtime.orig
    cp /usr/share/zoneinfo/Europe/Zurich /etc/localtime
    Ubuntu: to do
  4. To get the latest revision (bug fixes) from the release, in the directory /opt/nac just type 'svn update'.

Connect to the Web Interface

  1. To connect to the Web GUI, open your favorite web browser and type in the address bar the IP of your VM (which you seen with 'ifconfig' above).
  2. If the web page is displayed correctly, the the VM is running, on the network, and apache is running fine too.
  3. On the web page there should be a summary of documentation, links to the web gui and a copy of instruction on this page.
  4. Check in the "Web GUI" link, which leads to a "Read-only" interface and a "Read-Write" interface. These are described in XXX.
  5. Note that this interface is accessing the "opennac" database, which is empty after a fresh VM install.

Install the Windows Interface

  1. Download the Windows GUI (vmps.exe and vmps.xml) and save a copy to two folders, for example called FreeNAC_demo and FreeNAC_test.
  2. FreeNAC_demo will be used to connect to the demo dataset 'nacdemo', to better understand how to use the GUI.
    • Edit vmps.xml and set the 'mysql server' parameter to the IP address of the VM, and set the 'mysql database' to 'nacdemo'.
    • Start the GUI and press 'connect'.
  3. FreeNAC_test is used to connect to the 'opennac' dataset, which is initially empty an will be used to when FreeNAC talks to switches and rouoters in your environment.
    • Configure vmps.xml and set the 'mysql server' parameter to the IP address of the VM, and set the 'mysql database' to 'nacdemo'.
    • To do: create a user to allow the GUI access.
      XXXXX
    • Start the GUI and press 'connect'.
  4. See the Users Guide (http://freenac.net/en/community?q=en/usersguide) for a description of how to use the Windows interface.

Connecting Switches to FreeNAC

Point your switch(es) to the FreeNAC VM (see the technical Guide (http://freenac.net/en/techguide). Observe syslog and play with the GUIs.

Using FreeNAC in 802.1x mode

Using the FreeNAC virtual machine with 802.1x

This virtual machine includes support for 802.1x which provides for stronger security. User authentication is performed against a windows domain controller so ensure you have one in place. If you don't, you can still enjoy of a fully functional LAN Access Control since it is already configured to do so. The 802.1X default configuration is intended to allow you to authenticate users against Active Directory, and then validate devices and assign them a VLAN.

Presumably you already have a functioning Active Directory domain, and know how to run it. AD is very dependent on DNS (domain name system) so first you'll need to add an entry for your FreeNAC virtual machine in your DNS. Once you've added this entry, we need to configure kerberos.

Clock synchronization is so important in the security of the Kerberos protocol. If clocks are not synchronized within a reasonable window, Kerberos will report fatal errors and refuse to function. Clients attempting to authenticate from a machine with an inaccurate clock will be failed by the KDC in authentication attempts due to the time difference with the KDC's clock. This is why it is so important to have the clock of your virtual machine configured properly. This virtual machine is configured to use the Zurich's timezone, so if you live in a different part of the globe, you'll need to change the configuration of your timezone.

Change to the directory to /usr/share/zoneinfo, here you will find a list of time zone regions. Choose the most appropriate region, if you live in Canada or the US this directory is the "Americas" directory.

If you wish, backup the previous timezone configuration by copying it to a different location. Such as

   mv /etc/localtime /etc/localtime-old

Make a symbolic link from the file with the appropiate timezone to /etc/localtime.

   ln -s  /usr/share/zoneinfo/Europe/Amsterdam /etc/localtime

Then, adjust the time of your virtual machine by using the command date. The syntax of the date command is 'date MMDDhhmmYYYY'. So, let's say it is January 30 2010, 13:35, you type:

   date 013013352010

This will set the right time for your computer. You verify that the time is correct by typing 'date' again with no parameters.

   date

and it will display the time you specified in the previous step.

The Network Time Protocol (NTP) is available for the time synchronization of servers. Add an entry in your crontab to synchronize the clock of your virtual machine with an external time source.

   crontab -e

A text editor will appear with some entries in it. The existent entries are required for the proper functioning of FreeNAC. Add the next entry at the beggining of the file:

   #Time synchronization
   0 0 * * *        /usr/sbin/ntpdate server > /dev/null 2>&1

Save your changes. This entry will synchronize every midnight your VM's clock with the one of server.

Next, set the hardware clock. Do this by

   hwclock --systohc

Then, restart your VM.

Once it is up again, we need to modify the configuration files for Kerberos to work.
Edit /etc/krb5.conf. The provided krb5.conf file is as follows:

   [libdefaults]
        default_realm = DOMAIN.COM
        dns_lookup_real = false
        dns_lookup_kdc = false

   [realms]
        DOMAIN.COM = {
                default_domain = domain.com
                kdc = ad.domain.com
                admin_server = ad.domain.com
        }
   [logging]
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmin.log
    default = FILE:/var/log/krb5lib.log

Modify the lines

   default_realm = DOMAIN.COM
   DOMAIN.COM = {
   default_domain = domain.com

And change domain.com for your domain. Mind the case.
For the lines

   kdc = ad.domain.com
   admin_server = ad.domain.com

You specifiy your Active Directory domain server.
Save your changes, and then check that you get no error from typing

   kinit Administrator

It'll request you for the Administrator password to create a ticket in your system.
If you get errors, check again your /etc/krb5.conf file.

Even if your DNS servers are perfect in every way, it is a good idea to add important servers to your local /etc/hosts file. It speeds up lookups and provides a fallback in case the DNS servers go down. So, add the entry for your Active Directory domain server in /etc/hosts.

Sample:
   192.168.1.1        ad.domain.com    ad

Once you have this part working, let's configure Samba.
Modify the file /opt/samba/lib/smb.conf. The provided smb.conf file is as follows:

   [global]
        workgroup = domain
        security = ads
        idmap uid = 16777216-33554431
        idmap gid = 16777216-33554431
        template shell = /bin/bash
        winbind use default domain = no
        password server = ads.domain.com
        realm = domain.com
   [homes]
        comment = Home Directories
        browseable = No
        writable = yes

Modify the lines

   workgroup = domain
   password server = ads.domain.com
   realm = domain.com

With the appropiate values for your domain. Start Samba

   /etc/init.d/smbd start

Verify that it started

   ps uax ¦ grep smbd

And check for errors in /opt/samba/var/log.smbd. If errors are present, check again your sbm.conf file. Once Samba has started correctly, do:

   net join

This will join your VM to the domain. You can verify that your computer has joined the domain by typing

   klist

This should display valid Kerberos tickets and one of those is from your Active Directory domain server.
Now, start winbind

   /etc/init.d/winbindd start

Verify that windbind is working. This command pulls a list of users from AD

   wbinfo -u

And check for errors in /opt/samba/var/log.winbindd. If it started successfully, it will create another log file called log.wb-DOMAIN.
Once we have winbindd running, let's activate both smbd and winbindd as a service, so next time you restart your VM they'll be started automatically

   chkconfig smbd on
   chkconfig winbindd on

We have done all this just to get ntlm_auth running.
Now, let's try to auth with NTLM
 
  ntlm_auth --request-nt-key --domain=domain.com --username=Administrator
  password:
  NT_STATUS_OK: Success (0x0)

This success message indicates that Samba is properly configured to authenticate users using AD, which is what we need for FreeRadius.

Now, let's configure FreeRadius.

Modify the file /usr/local/etc/raddb/clients.conf and add the switches you want to talk to this Radius server. Don't forget to specify the shared secret between this Radius server and your switch. In this configuration there are plenty of examples of how to define an entry for this file. You need to specify these entries in this file, otherwise the Radius server will ignore the incoming requests.

Another configuration file that you may modify is the /usr/local/etc/raddb/eap.conf. The certificates defined in this file are the ones provided by FreeRadius. These certificates are not intended to be used in a production environment. You will need to create your own certificates later on. If you only want to perform test, these will work.

The /usr/local/etc/raddb/radiusd.conf file is the main configuration file. This file will authenticate the username against your AD through ntlm_auth and then will authenticate the device and will assign a VLAN to it through the perl script /opt/nac/bin/rad2vmps. You don't need to modify anything. It is all set to start working right away.

Now, run
 
   /etc/init.d/radius debug

 If you get at the end of all the text the line:

Ready to process requests.

Your FreeRadius server is properly running. Now, press Ctrl+C to interrupt it, and activate the service

   chkconfig radius on

And start the daemon

   /etc/init.d/radius start

The configuration regarding your VM is finished. You only need to configure your switches to speak 802.1X to your FreeRadius and enable 802.1x in your computers.
If you have further questions, problems or comments, please post them in our forum.

3. Linux platform Installation

This section describes how to install Linux and the components needed for NAC.

Overview

The steps involved are:

  1. Install Linux
  2. Install additional key components:
    freetds, libxml, latest LAMP: PHP5/Apache2/MySQL
  3. Install optional components for 802.1x support Samba and FreeRadius are also needed.
  4. Harden: disable unneeded services.
  5. Configure linux: configure email, syslog, time synchronisation, DNS, shell profile, system monitoring scripts

Once linux is installed, FreeNAC also needs to be installed, and the key components (FreeTDS, freeradius, Apache, PHP, MySQL) & FreeNAC configured.

Linux

Linux required packages: ncurses-devel gcc-c++ gd-devel freetype2-devel zlib-devel libpng-devel libjpeg-devel net-snmp net-snmp-devel tcpd-devel rpm-devel
openssl openssl-devel openldap2-devel graphviz

Linux key components: mysql-client mysql-server libxml samba apache php5

Additional components: freeradius, freetds.

Optional, but useful packages: traceroute, whois.

 

Linux Installation notes: Suse

A. Introduction

This section describes Suse (version 9.3) specific commands.

B. Installing Suse packages

Packages to install: rcs xntp sharutils tcpdump iptraf whois nmap automake gcc ethereal rsync lynx links pin scanlogd rsync uudeview ltrace smartmontools zip unzip pcre net-snmp ntop arpwatch perl-dbi flex pytn python-dev

a) via the nework
Yast -> Network services -> proxy
http://YOUR.PROXY.COM:80/

Set Patch source 9.x in Switzerland
http://mirror.switch.ch/ftp/mirror/SuSE/suse/
Install source 9.x:
http://sunsite.cnlab-switch.ch//ftp/mirror/suse/suse/i386/9.3/
sunsite.cnlab-switch.ch /ftp/mirror/suse/suse/i386/9.3/

yast -i
yast online_update

b) or, if you have no internet access,
by downloading the Suse 9.3 ISO images to /opt/install/suse9.3
and then mounting/unmounting a CD as needed:
umount /mnt/cd
mount -o loop -t iso9660 /opt/install/suse9.3/cd1.iso /mnt/cd

In Yast, set the install source to the local directory "/mnt/cd".

C. Linux preparation

Create /etc/mods (documentation of system changes)

/etc/hosts : timehost, loghost, mailhost

rcSuSEfirewall2 stop
chkconfig SuSEfirewall2 off
chkconfig SuSEfirewall2_init off
chkconfig SuSEfirewall2_setup off

rcportmap stop
chkconfig nfs off
chkconfig nfsboot off
chkconfig portmap off

chkconfig mdnsd off
rcmdnsd stop

## optional
vi /etc/snmpd.conf [enable a read-only community if you want SNMP monitoring]
rcsnmpd start
chkconfig snmpd on

Disable powersaving on servers and especially VMs:
/etc/sysconfig/powersave/cpufreq
POWERSAVE_CPUFREQD_MODULE="off"

Email
Yast -> Network services -> mail transfer agent
Outgoing mail server = [YOUR_OUTBOUND_SERVER]

vi /etc/aliases, and set "root" alias to the sysadmin
newaliases

Test email:
echo test | mailx -s "test" root

Time sync
cp /etc/localtime /etc/localtime.orig
cp /usr/share/zoneinfo/Europe/Zurich /etc/localtime [Switzerland]
cron:
0,30 7-20 * * 1-5 /usr/sbin/ntpdate -s A.B.C.D X.Y.Z.Z; /sbin/hwclock --systohc

Setup syslog for centralised logging to the master server:
In /etc/hosts, add an entry for each NAC server
XX vmps1
YY vmps2

On the Master, enable the syslog server:
vi /etc/syslog-ng/syslog-ng.conf.in

# uncomment to process log messages from network:
#
udp(ip("0.0.0.0") port(514));

SuSEconfig
rcsyslog restart

Slave: syslog client:
/etc/syslog-ng/syslog-ng.conf.in
## Forward *.info to loghost
filter f_info { level(info) ; };
destination network { udp("loghost" port(514)); };
log { source(src); filter(f_info); destination(network); };

add loghost to the vmps2 line in /etc/hosts

SuSEconfig
rcsyslog restart

change the root GECOS field in /etc/passwd to "root MACHINE"

Also check: /root/.ssh/authorized_keys

naming:
vi /etc/resolv.conf

If you use DNS domains with ".local", then replace dns library since Suse
does not like domains ending int ".local". Backup libresolv.so.2 and create a new /lib/libresolv.so.2.orig that is not so brain dead:
cd /lib cp libresolv.so.2 libresolv.so.2.orig
cat libresolv.so.2.orig |sed 's/local/lokal/g' > libresolv.so.2.NO_LOCAL
cp libresolv.so.2.NO_LOCAL libresolv.so.2

If SSH logins seem very slow, you might have to replace LOCAL with 127.0.0.1 in /etc/hosts.allow for the sshd entry.

D. additional extras

create /secure check_disk, monitor_processes, secure.conf
ln -s /usr/bin/perl /bin/perl

Environment
copy /etc/profile.local from another machine
. /etc/profile.local

Setup filewatch
mkdir -p /var/filewatcher/archive
copy /usr/local/bin/filewatcher from another machine
copy /etc/filewatcher.conf from another machine
filewatcher -c /etc/filewatcher.conf
Setup Cron entry:
2 6-18 * * 1-5 /usr/local/bin/filewatcher -c /etc/filewatcher.conf

check_disk in root cron
*/3 * * * * /secure/check_disk 90 800

Linux Installation notes: Ubuntu

Introduction

For the Ubuntu VM, we have used used the image "Alternate Desktop CD" from the 6.06 LTS version, which you can download from the Ubuntu website. This version doesn't include the Live CD, instead it uses a text-based installer.

We installed the LAMP server that comes with Ubuntu. This will install Apache2, MySQL5 and PHP5.

Modify the instalation sources by uncommenting the lines starting with deb from the /etc/apt/sources.list file and comment out the lines with deb cdrom

sudo vi /etc/apt/sources.list
sudo apt-get update

And then upgrade the existing packages

sudo apt-get upgrade

[Optional] Edit the file /boot/grub/menu.lst and add the following
vga=773
at the end of the line "kernel" in the section where you running kernel is and reboot the server. This will give you more lines in your console, so you won't be constrained to a 80x25 lines resolution.

In Ubuntu, to install a package, you do it with

sudo apt-get install PACKAGE

where PACKAGE is the name of the package to install.

Installing Ubuntu Packages

As part of the FreeNAC installation, the following packages require to be installed:

  • flex
  • python-dev
  • apt-file
  • libsnmp-base
  • libsnmp9-dev
  • mailx
  • nmap
  • openssh-server
  • zip
  • unzip
  • syslog-ng
  • ncurses-dev
  • freetype2-dev
  • libjpeg-dev
  • libpng-dev
  • apache2-prefork-dev
  • php-pear
  • php5-snmp
  • libxml2-dev
  • freetds-dev
  • graphviz
  • subversion

The following packages, are optional:

  • rcs
  • sharutils
  • tcpdump
  • iptraf
  • whois
  • rsync
  • lynx
  • links
  • scanlogd
  • uudeview
  • ltrace
  • ntop
  • arpwatch
  • smartmontools
  • traceroute
  • screen

Linux preparation

Create the file /etc/mods where you'll store the changes made to your system
sudo touch /etc/mods

Add in /etc/hosts definitions for timehost, loghost and mailhost

In the file /etc/aliases there should be an alias for root. Usually the user that receives mail for root is freenac. Test email:

echo test | mailx -s "test" root

The freenac user should receive a test email

From the installation, you should have set your time zone properly. In case you haven't, copy from the /usr/share/zoneinfo directory the file that best suits your timezone.

In our case:
cp /etc/localtime /etc/localtime.orig (create a backup of the original timezone)
cp /usr/share/zoneinfo/Europe/Zurich /etc/localtime (Timezone of Switzerland)

And adjust your crontab to update the current time from an NTP server

#Entry in cron
0,30 7-20 * * 1-5 /usr/sbin/ntpdate -s A.B.C.D X.Y.Z.Z; /sbin/hwclock --systohc
where A.B.C.D X.Y.Z.Z are NTP servers to synchronize from.

Change the root GECOS field in /etc/passwd to "root MACHINE"

Also check: /root/.ssh/authorized_keys

Compiling key non-FreeNAC components from sources

Introduction

This document explains how to compile key components from source, if needed. It is recommended to use the packages that are included with your distribution if possible, since automated updates will be easier.

It was last updated in Mar'07, and refers to versions available on that date.

Download

You'll need to download the packages, always use the latest releases, the following are example URLs.

http://mirror.switch.ch/ftp/mirror/apache/dist/httpd/httpd-2.2.2.tar.gz
http://mirror.switch.ch/ftp/mirror/mysql/Downloads/MySQL-5.0/mysql-5.0.2...
ftp://fr.rpmfind.net/pub/libxml/libxml2-2.6.23.tar.gz
http://www.ibiblio.org/pub/Linux/ALPHA/freetds/stable/release_candidates...
http://ch2.php.net/get/php-5.2.0.tar.bz2/from/this/mirror

Apache

cd /opt/install
tar xvzf httpd-2.2.2.tar.gz
cd httpd-2.2.2
./configure --prefix=/usr/local/apache2 --enable-so
make install
ln -s /usr/local/apache2 /usr/local/apache
ln -s /usr/local/apache2/bin/apachectl /etc/init.d/apache2
ln -s /usr/local/apache2/bin/apachectl /sbin/rcapache2

# Actually start apache if you intend using the web interfaces, see below:
chkconfig apache2 on
/etc/init.d/apache2 start

MYSQL 5

Prerequisites: ncurses-devel gcc-c++

cd /opt/install
tar xvzf mysql-5.0.27.tar.gz
cd mysql-5.0.27
./configure --prefix=/usr/local/mysql-5.0.27 --localstatedir=/mysqldata --with-unix-socket-path=/var/lib/mysql/mysql.sock
make install

cd /usr/local
mv mysql mysql.$$ [in case you have a link already]
ln -s mysql-5.0.27 mysql
ln -s /usr/local/mysql/bin/mysqld_safe /usr/local/mysql/bin/mysql

Create a mysql user:
groupadd mysql
useradd -g mysql mysql

Create an empty database:
cd /usr/local/mysql
bin/mysql_install_db --user=mysql
mv data /var/lib/mysql

ln -s /var/lib/mysql data
ln -s /var/lib/mysql /mysqldata
ln -s /var/lib/mysql/mysql.sock /tmp/mysql.sock

Set permissions:
chown -R mysql:mysql /mysqldata /var/lib/mysql

libxml

cd /opt/install
tar xvzf libxml2-2.6.24.tar.gz
cd libxml2-2.6.24/
./configure --prefix=/opt/libxml2 && make install

FreeTDS

If you need to access MS-SQL or Sybase Enterprise databases.

cd /opt/install
wget http://www.ibiblio.org/pub/Linux/ALPHA/freetds/stable/release_candidates...
tar xvzf freetds-0.64RC2.tar.gz
cd freetds-0.64RC2
./configure --prefix=/opt/freetds --enable-msdblib
make install
vi /opt/freetds/etc/freetds.conf and add a definition to a DB to test:
[sms] <-- alias name
host = MyServer.mydomain.com <-- sever name/IP
port = 1433
tds version = 4.2
dump file = /var/log/freetds.log
dump file append = yes
#debug level = 10
debug level = 3

Try connectivity:
/opt/freetds/bin/tsql -S [alias] -U [user] -P [password]

PHP5

Install first the prerequisites packages, PHP is built with many options enabled: gd-devel freetype2-devel zlib-devel libpng-devel libjpeg-devel
net-snmp net-snmp-devel tcpd-devel rpm-devel
openssl openssl-devel openldap2-devel graphviz

cd /opt/install;
tar xBf php-5.2.0.tar.bz2
cd php-5.2.0

## If you need MS-SQL (its best to assume you do - FreeTDS was compiled above)
./configure --with-apxs2=/usr/local/apache2/bin/apxs --with-mysql=/usr/local/mysql --with-mysql-sock=/var/lib/mysql/mysql.sock --prefix=/opt/php-5.2.0 --with-xml --with-libxml-dir=/opt/libxml2 --enable-pcntl --enable-force-cgi-redirect --with-mssql=/opt/freetds --with-gd --with-zlib-dir --with-ttf --with-freetype-dir --with-snmp=/usr --enable-ucd-snmp-hack --with-ldap

make install

Disable any current php binaries, and enable the new ones:

mv /usr/bin/php /usr/bin/php.$$
mv /opt/php5 /opt/php5.$$
ln -s /opt/php-5.2.0 /opt/php5
ln -s /opt/php5/bin/php /usr/bin/php

Test PHP:
php -v

Note:

  • On Suse Linux, PHP may complain about MySQL libraries, it may be best to compile MySQL from source (see above), rather than using binary packages.
  • If MS-SQL support (via TDS) is not needed in PHP, the build line is simpler:
    ./configure --with-apxs2=/usr/local/apache2/bin/apxs --with-mysql=/usr/local/mysql --prefix=/opt/php-5.2.0 --with-xml --with-libxml-dir=/opt/libxml2 --enable-pcntl --enable-force-cgi-redirect --with-gd --with-zlib-dir --with-ttf --with-freetype-dir --with-ldap
  • To allow easier upgrading, rollback or testing new PHP modules, we install into a version specific directory like '/opt/php5.2.0' above, and create links to this directory.

Enable PHP in apache:

Edit your httpd.conf (e.g. /usr/local/apache/conf/httpd.conf) to load the PHP module

    LoadModule php5_module modules/libphp5.so

The path on the right hand side of the LoadModule statement must point to the path of the PHP module on your system. Then "make install" from above may have already added this for you, but be sure to check. Also, tell Apache to parse certain extensions as PHP in httpd.conf
AddType application/x-httpd-php .php .phtml
AddType application/x-httpd-php-source .phps

 

Building 802.1x components

0. Introduction

This section describes how to configure FreeRadius to authenticate users in Active Directory or using certificates.

1. Software required

To authenticate users in Active Directory, make sure you have the following installed in your system:

  • Kerberos development libraries
  • OpenLDAP development libraries
  • Samba
  • Winbind
  • FreeRadius

2. Configure & test Kerberos & Samba

Create or modify the file smb.conf to include the following minimum configuration (change for your Windows environment)

[global]
workgroup = domain
security = ads
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
template shell = /bin/bash
winbind use default domain = no
password server = ads.domain.com
realm = domain.com

[homes]
comment = Home Directories
browseable = No
writable = yes

Presumably you already have a functioning Active Directory domain, and know how to run it. AD is very dependent on DNS (domain name system) so first you'll need to add an entry for your server in your DNS.

Once you've added this entry, we need to configure kerberos. Edit the file krb5.conf and add in the realms section info concerning your domain.
Your krb5.conf file should look like

[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_real = false
dns_lookup_kdc = false

[realms]
DOMAIN.COM = {
default_domain = domain.com
kdc = ads.domain.com
admin_server = ads.domain.com
}

[logging]
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log
default = FILE:/var/log/krb5lib.log

Modify the lines

default_realm = DOMAIN.COM
DOMAIN.COM = {
default_domain = domain.com

And change domain.com for your domain. Mind the case.
For the lines

kdc = ad.domain.com
admin_server = ad.domain.com

You specifiy your Active Directory domain server.

Clock synchronization is so important in the security of the Kerberos protocol.
If clocks are not synchronized within a reasonable window, Kerberos will report fatal errors and refuse to function.
Clients attempting to authenticate from a machine with an inaccurate clock will be failed by the KDC in authentication attempts due to the time difference with the KDC's clock.
Ensure you have your clock properly configured. If you want to use an external source to synchronize your server use ntp.

The Network Time Protocol (NTP) is available for the time synchronization of servers.
Add an entry in your crontab to synchronize the clock of your computer with an external time source adding the next entry.

#Time synchronization
0 0 * * * /usr/sbin/ntpdate server > /dev/null 2>&1

Save your changes. This entry will synchronize every midnight your clock with the one of server.

Even if your DNS servers are perfect in every way, it is a good idea to add important servers to your local /etc/hosts file. It speeds up lookups and provides a fallback in case the DNS servers go down. So, add the entry for your Active Directory domain server in /etc/hosts.

192.168.1.1        ad.domain.com    ad

Check that you get no error from typing

 kinit Administrator

This will ask you for the administrator's password. Make sure you know it beforehand.
Possible causes of error are:

  • Clocks not properly synchronized
  • DNS resolution

Edit the file /etc/nsswitch.conf and add winbind at the end of the following lines:

passwd:
group:
protocols:
services:
netgroup:
automount:

If everything went ok, start Samba and verify that it started. Check for errors in the Samba log. If errors are present, check again your smb.conf file. Once Samba has started correctly, do:

net join

This will join you to the domain. You can verify that your computer has joined the domain by typing

klist

This should display valid Kerberos tickets and one of those is from your Active Directory domain server.
Now, change the group that the lock winbindd_privileged belongs to

chgrp radiusd /opt/samba/var/locks/winbindd_privileged

This is done because we'll run freeradius as the radiusd user, and this user needs to access this lock in order to perform the authentication against the Windows Domain

Now change its permissions

chmod 750 /opt/samba/var/locks/winbindd_privileged

And start winbind

/etc/init.d/winbindd start

Verify that windbind is working. This command pulls a list of users from AD

wbinfo -u

And check for errors in the winbindd log. If it started successfully, it will create another log file called log.wb-DOMAIN. Once we have winbindd running, activate both smbd and winbindd as services if they are not already activated.

All this has been done in order to get ntlm_auth to run. Try to auth with NTLM

ntlm_auth --request-nt-key --domain=domain.com --username=Administrator
password:
NT_STATUS_OK: Success (0x0)

This success message indicates that Samba is properly configured to authenticate users against AD, which is what we need for FreeRadius.

3. Configure Freeradius

Configure the known access points in FreeRadius

mv /usr/local/etc/raddb/clients.conf /usr/local/etc/raddb/clients.conf.$$
cp /opt/nac/contrib/freeradius/etc/raddb/clients.conf /usr/local/etc/raddb/clients.conf

Then, edit /usr/local/etc/raddb/clients.conf to include the NAS (switches or APs) that will contact our Freeradius server; change ip addresses and PASSWORD1/2/3
Configure the /usr/local/etc/raddb/radiusd.conf file, this example uses Windows logon

mv /usr/local/etc/raddb/radiusd.conf /usr/local/etc/raddb/radiusd.conf.$$
cp /opt/nac/contrib/freeradius/etc/raddb/radiusd.conf.winlogon+macauthbypass /usr/local/etc/raddb/radiusd.conf

Another configuration file that you may modify is /usr/local/etc/raddb/eap.conf. The certificates defined in this file are the ones provided by FreeRadius. These certificates are not intended to be used in a production environment. You will need to create your own certificates later on. If you only want to perform test, these will work. If you want to generate your own certificates, please see http://freenacweb.vptt.ch/en/node/278 which contains information about how to generate certificates for your FreeRadius server if you have a Windows CA.

Start radius in debug mode to see if there are errors

radiusd -xX

If you get at the end the line:

Ready to process requests.

Then you are done. You are reading to authenticate users in the windows domain and validate devices.

4a. Master Server initial configuration

This sections describes the instllation of the master server components.

1. MySQL configuration

Getting FreeNAC core

Start by downloading the latest stable release nac tarball from FreeNac.net, copying to /opt, and extracting it into /opt/nac. Or, checking out directly from Subversion.

mkdir /opt/nac
svn co https://opennac.svn.sourceforge.net/svnroot/opennac/branches/2.2 /opt/nac

MySQL Installation settings

General

Ensure that mysql starts automatically (e.g. 'chkconfig mysql on' on RedHat/Suse systems).

Add the path to 'mysql' to your PATH for ease of use.

Set a softlink "/mysqldata" to point to the mysql database directory, for example '/var/lib/mysql'. In most of the documentation we refer to /mysqldata for brevity.

ln -s /var/lib/mysql /mysqldata 

my.cnf

Compare your /etc/my.cnf with /opt/nac/contrib/etc/my.cnf, for paramters that may need to be set.

e.g. Adapt log-bin and report-host to include hostname:

    log-bin=vmps1-bin
    report-host= vmps1

Permissions

Ensure the mysql user can write to the database files.

chown -R mysql /mysqldata /var/lib/mysql

Change the mysql 'root' password, if the server is multi-user (not restricte to one or two trusted administrators).

Initial FreeNAC empty dataset

Install an initial set of empty FreeNAC tables for the 'opennac' database, backing up the existing tables first:

    cd /mysqldata
    cp opennac opennac.$$  
    cp /opt/nac/contrib/opennac_db.tar.gz .
    tar xvzf opennac_db.tar.gz
mysql opennac < tables.sql
mysql opennac < values.sql

Start mysql:

    /etc/init.d/mysql start  

check /mysqldata/localhost.err for errors.

Login to sql and look at a few tables, they should exist, but be empty:

    mysql opennac
show tables;
select * from ports;

Database rights

There are 4 mysql users needed for accessing the database.

A. Local daemon user for PHP scripts: inventwrite@localhost
B. A user for the remote Delphi Windows GUI: inventwrite@'%'
C. Root is used by the sysadmin for local configuration. By default root
is only allowed from localhost, and has no password. Its is
recommended that you set a root password for mysql root, if the NAC
server login is accessible to several users.
D. The Web1 GUI has a specific user%localhost, by default called "readonly".
E. The Web2 GUI has a specific user%localhost, by default called "webwrite".

Local daemon user for PHP scripts (set the user/pw in /opt/nac/config.inc):
grant SELECT,INSERT,UPDATE ON opennac.* to inventwrite@localhost IDENTIFIED by 'PASSWORD2';
SET PASSWORD FOR inventwrite@localhost = OLD_PASSWORD('PASSWORD2');

grant SELECT,INSERT,UPDATE,DELETE ON opennac.systems to inventwrite@localhost;
grant CREATE TEMPORARY TABLES ON opennac.* to inventwrite@localhost;
grant ALL ON opennac.vmpsauth to inventwrite@localhost;

Remote delphi Windows GUI user. See also the vmps.ini file on the Windows client.
grant SELECT,INSERT ON opennac.* to inventwrite@'%' IDENTIFIED by 'PASSWORD1';
SET PASSWORD FOR inventwrite@'%' = OLD_PASSWORD('PASSWORD1');

grant SELECT,UPDATE ON opennac.oper to inventwrite@'%' ;
grant SELECT,UPDATE ON opennac.config to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.building to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.location to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.port to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.switch to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.vlan to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.systems to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.users to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.patchcable to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.vlanswitch to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.cabletype to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_class to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_class2 to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os1 to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os2 to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os3 to inventwrite@'%';

The read-only webgui Web1 needs "read" access and by default uses a user
named 'readonly'. See also /opt/nac/web1/config.inc.
grant SELECT ON opennac.* to readonly@'localhost' IDENTIFIED by 'PASSWORD1';

The webgui Web2 needs "read-write" access and by default uses a user
grant SELECT,INSERT ON opennac.* to webwrite@'localhost' IDENTIFIED by 'PASSWORD1';
SET PASSWORD FOR webwrite@'localhost' = OLD_PASSWORD('PASSWORD1');
grant SELECT,UPDATE ON opennac.systems to webwrite@'localhost' ;
grant SELECT ON opennac.users to webwrite@'localhost' ;
grant SELECT ON opennac.patchcable to webwrite@'localhost' ;
grant SELECT,UPDATE ON opennac.port to webwrite@'localhost' ;
grant SELECT ON opennac.oper to webwrite@'localhost' ;
grant SELECT ON opennac.switch to webwrite@'localhost' ;
grant SELECT ON opennac.vlan to webwrite@'localhost' ;
grant SELECT,INSERT,UPDATE ON opennac.sys_class to webwrite@'localhost' ;
grant SELECT,INSERT,UPDATE ON opennac.sys_os to webwrite@'localhost';
grant SELECT ON opennac.nac_openports to webwrite@'localhost' ;

Regular housekeeping with cron

The cron tool is where all regular tasks are done to keep the system healthy. The following are recommended regualr tasks.

Remove 'unknowns' from the DB, that were never authorised and are very old:
0 1 * * 1 /opt/nac/bin/purge_unknowns

Clean mysql logs on the 1st per month
0 6 30 * 1 /usr/local/mysql/bin/mysql -uroot -e "PURGE MASTER LOGS BEFORE DATE_SUB( NOW( ), INTERVAL 30 DAY);"

The following are scripts to backup the system in different ways to the second internal disk. These are highly system specifc, make sure you understand, tune and test them (e.g. you will need a '/disk2' partition).

0 3 * * 1-5 /opt/nac/bin/dump_ports
0 3 * * 1 /usr/local/mysql/bin/mysqlhotcopy --allowold --keepold --regexp=".+" /disk2/backups/mysql 2>&1 | logger
0 3 * * 6 rdiff-backup --exclude /media --exclude /sys --exclude /disk2 --exclude /proc --exclude /mnt --print-statistics / /disk2/backups/vmps0.rdiff;

Changing the mysql root password

If the NAC server is not exclusively used by one administrator, you may want to set a local root password for mysql. This make administratig more difficult though, and some cron scripts will need to be adapted to provide a password.

mysqladmin -u root password 'new-password'
mysqladmin -u root -h MYHOST password 'new-password'

2. Syslog server

The NAC server needs to have a syslog server to collect messages locally, and from any slave servers.

Its also useful, though not mandatory, for switches to send a copy of their events via syslog too. 

Configure the syslog damon to listen to the network interface for messages, e.g. by starting with the "-r" option. Syslog-ng needs a directive for the network interface. Somare examples are:

  • On Suse Linux,  set SYSLOGD_PARAMS="-r" in /etc/sysconfig/syslog, and possibly also "udp(ip("0.0.0.0") port(514));" in 'source src' of /etc/syslog-ng/syslog-ng.conf .
  • With Ubuntu 6.04, SYSLOGD="-u syslog -r" in /etc/init.d/sysklogd

A log pruning configuration file is provided with FreeNAC, review it and then activate:

cp /etc/logrotate.d/syslog /etc/logrotate.d/syslog.$$  
cp /opt/nac/contrib/logrotate.d/syslog /etc/logrotate.d/syslog  

Add a cron entry to prune syslog, for example on weekday mornings:
 
# Log pruning
0 6 * * 1-5            /usr/sbin/logrotate /etc/logrotate.conf | logger

3. PHP settings

To do:

  • document recommended settings for /etc/php5/cli/php.ini or relevant php5.ini file.

The 'php.ini-recommended' file included in the PHP distribution, or the contrib/etc_php5_cli/php.ini of FreeNAC should be used in case of doubt.

4. FreeNAC daemons

FreeNAC core: installing /opt/nac

Start by downloading the latest stable release nac tarball from FreeNac.net, copying to /opt, and extracting it into /opt/nac. Or, checking out directly from Subversion.

mkdir /opt/nac
svn co https://opennac.svn.sourceforge.net/svnroot/opennac/branches/2.2 /opt/nac

config.inc

Create a config.inc from a template and set especially the DB connection parameters:
cp /opt/nac/etc/config.inc.template /opt/nac/etc/config.inc
vi /opt/nac/etc/config.inc

Once you're happy with your settings, you need to import the config file into the database. To do so:

cd /opt/nac/contrib
./config2db ../etc/config.inc

Start the vmps daemon

Creating a startup file and start the service:

cp /opt/nac/contrib/startup_init.d/vmps /etc/init.d/vmps
ln -s /etc/init.d/vmps /usr/sbin/rcvmps
chmod 750 /etc/init.d/vmps
chkconfig vmps on
vi /etc/init.d/vmps [adapt IP address on vmpsd start line]

Start and watch syslog for events:
rcvmps start
tail -f /var/log/messages

Start the vmps_lastseen daemon

cp /opt/nac/contrib/startup_init.d/vmps_lastseen /etc/init.d/vmps_lastseen
ln -s /etc/init.d/vmps_lastseen /usr/sbin/rcvmps_lastseen
chmod 750 /etc/init.d/vmps_lastseen
chkconfig vmps_lastseen on

Start and watch syslog for events:
rcvmps_lastseen start
tail -f /var/log/messages

5. Router integration

Routers can be queried regularly to discover the IP addresses attributed to MAC addresses.

  • Adapt the relevant lines in config.inc
  • then try route_mac_ip from the command line, possibly enabling the debug flags
  • Then add an entry to the root cron:
    */6 * * * * /opt/nac/bin/router_mac_ip

6. Switch integration

Switch configuration

Parameters to set on switches are covered in the FreeNAC Techincal Guide, 'Configuring Network Switches' chapter. http://FreeNAC.net/en/techguide

Port restarting

The Windows GUI has a "restart port" button that sets a flag in the database. The following script is then called from cron every minute, checking the DB for ports to restart and sending a SNMP command to the relevant switch.

Installation:

  • Adapt the relevant lines in config.inc
  • Test from the command line, possibly enabling the debug flags.
  • Then add an entry to the root cron:
    * * * * * /opt/nac/bin/cron_restart_port

Scanning of MAC tables via SNMP

As of release 2.2 RC2, the community edition counts with the snmp_scan.php script. This script's task is to register devices' information which are currently connected to your switches. This script scans the switches which in the switch table have the flag scan=1.

Its main function is go to the switch, and by means of SNMP queries, documents information that can be helpful for a system administrator, such as:

  • Switch's hardware version
  • Switch's software version
  • Ports on the switch
  • VLANs on the switch
  • MAC address of the devices currently connected to the switch
  • VLAN currently used by to those devices
  • If a port is configured as static, dynamic or trunk

To configure it for use, you need to first declare which switches are goind to be scanned.

update switch set scan='1' where ip='192.168.0.1';

In config.inc, modify the value of snmp_ro and snmp_rw if you haven't done so. This variables contain the SNMP communities which are used to connect to your switches.

Once you have done so, run it from the command line for testing purposes:

cd /opt/nac/bin
./snmp_scan.php

This script can take some time, depending on the number of switches of your network.

To run from crontab, add an entry as follows:

#Scanning of switches
3 11 * * 1-5     /opt/nac/bin/snmp_scan.php | logger

7. Web interface

Description

The Web GUI is an alternative to the Windows GUI which allows to control some parts of the FreeNAC system.

As of release v2.2 RC2, the /web interface unites both /web1 and /web2 in a single interface. In the future we'll delete both /web1 and /web2 from our repository. Also, we have done some development for the /web interface that allows to validate user credentials against Active Directory using multiple domains in order to restrict the number of users who use this /web interface.

Basic installation

Install Apache & libraries for graphics: this should have been done as part of your server installation, however, for completeness:

  • Install Apache
  • Graphviz for the switch view
  • JPGraph for statistics (also required freetype & MS core fonts)
  • GD devel libraries

JPGraph may not be in your system's packages repository, so to install it, download the tarball from http://www.aditus.nu/jpgraph/jpdownload.php to your /opt directory. Then:

cd /opt
tar zxvf jpgraph-X.X.XX.tar.gz
ln -s jpgraph-X.X.XX jpgraph
ln -s jpgraph-X.X.XX /usr/local/share/jpgraph

[ Optional:
If you want to use the Excel export function you also need the following PEAR Module: Spreadsheet_Excel_Writer

To install Spreadsheet_Excel_Writer invoque the following command on your shell:

pear install --alldeps -f Spreadsheet_Excel_Writer 

]

Create a configuration file for the web interface. Copy the file /opt/nac/web/config.inc.template to /opt/nac/web/config.inc and adjust it according to your needs.

In the /opt/nac/web/config.inc file you need to define 3 different usernames.
One for using the database (the same as in the /opt/nac/etc/config.inc file)

  $dbhost="localhost";
$dbname="opennac";
$dbuser="inventwrite";
$dbpass="PASSWORD2";

Another one to use the write interface

   $writeuser="webwrite";                     
$writepass="PASSWORD1";

and another one to use the read interface

   $readuser = 'inventwrite'; 
$readpass = 'PASSWORD2';

We did so because maybe you want some users (desktop support) to be able to read information from the database, without actually doing modifications to it, and allow some other users (administrators) to make modifications to the systems in FreeNAC.

Change this file's permissions

chmod 640 /opt/nac/web/config.inc

And change the group this file belongs to, to the one that is used by apache to run the server. In my system, the username and group that are running my apache server are www-data, then

chgrp www-data config.inc

And change the owner of the /opt/nac/web/read/tmp directory as well

chown www-data /opt/nac/web/read/tmp

The Web GUI is located in /opt/nac/web, so we'll do a virtual directory in Apache pointing to this directory.

Locate your Apache main configuration file (it is distribution dependant) and add the definition of this virtual directory as follows:

Alias /nac /opt/nac/web
<Directory /opt/nac/web/>
Options None
Order deny,allow
Allow from all
</Directory>

<LocationMatch "\/nac.*\.inc\.*">
Deny from all
</LocationMatch>

This basic configuration doesn't restrict the use of this interface to anyone. If you want to restrict access only to a certain IP addresses, do the following:

Deny from all
Allow from 192.168.0.1 192.168.0.2

The LocationMatch stanza protects from reading all include files that you could contain within your /opt/nac/web directory. This is really important since your config.inc file, contains sensitive information such as usernames and passwords.

Make sure you have created and granted rights to the usernames that will use this interface. This is explained in the installation guide. In case you haven't done so:

 #The read-only webgui needs "read" access and by default uses a user  
#named 'readonly'.
grant SELECT ON opennac.* to readonly@'localhost' IDENTIFIED by 'PASSWORD1';

#The write webgui needs "read-write" access and by default uses a user
grant SELECT,INSERT ON opennac.* to webwrite@'localhost' IDENTIFIED by 'PASSWORD1';
SET PASSWORD FOR webwrite@'localhost' = OLD_PASSWORD('PASSWORD1');
grant SELECT,UPDATE ON opennac.systems to webwrite@'localhost' ;
grant SELECT ON opennac.users to webwrite@'localhost' ;
grant SELECT ON opennac.patchcable to webwrite@'localhost' ;
grant SELECT,UPDATE ON opennac.port to webwrite@'localhost' ;
grant SELECT ON opennac.oper to webwrite@'localhost' ;
grant SELECT ON opennac.switch to webwrite@'localhost' ;
grant SELECT ON opennac.vlan to webwrite@'localhost' ;
grant SELECT,INSERT,UPDATE ON opennac.sys_class to webwrite@'localhost' ;
grant SELECT,INSERT,UPDATE ON opennac.sys_os to webwrite@'localhost';
grant SELECT ON opennac.nac_openports to webwrite@'localhost' ;

Then start/restart/reload your apache server, point your web browser to http://yourserver/nac and you should see now the web interface.

Authentication against Active Directory

To configure Apache to authenticate users against Active Directory, we'll use the module mod_authnz_ldap from Apache. Check if in the list of compiled in modules there is an entry like:

mod_authnz_ldap.c

If so, we are ready to start configuring Apache and the Web interface. If not, install this module.

In your Apache main configuration file you have already defined an entry for /nac. To perform the authentication, you need to modify that entry as follows:

 Alias /nac /opt/nac/web
<Directory "/opt/nac/web/">
Options All ExecCGI -Indexes
Order deny,allow
Allow from all
AuthzLDAPAuthoritative off
AuthType Basic
AuthBasicProvider ldap
AuthUserFile /dev/null
AuthName "Sensitive Zone"
AuthLDAPBindDN cn=Administrator,cn=Users,dc=domain,dc=com
AuthLDAPBindPassword password
AuthLDAPURL "ldap://server.domain.com/?userPrincipalName?sub?(&(objectClass=person)(objectClass=user))"
require valid-user
</Directory>

<LocationMatch "\/nac.*\.inc\.*">
Deny from all
</LocationMatch>

AuthLDAPBindDN is an optional DN used to bind to the server when searching for entries. If not provided, mod_authnz_ldap will use an anonymous bind.
AuthLDAPBindPassword is a bind password to use in conjunction with the bind DN.
AuthLDAPBindDN and AuthLDAPBindDN should only be used if no anonymous bind is allowed.
AuthzLDAPAuthoritative prevents other authentication modules from authenticating the user if this one fails. Set to off if this module should let other authentication modules attempt to authenticate the user, should authentication with this module fail.

If you have more than one domain, you should be using global catalog. Global catalog uses port 3268. Global Catalog is a read only copy of selected attributes of all the Active Directory servers within the Active Directory forest. Querying the Global Catalog allows all the domains to be queried in a single query, without the query spanning servers over potentially slow links.

To use the Global Catalog, you just need to subsitute the line

AuthLDAPURL "ldap://server.domain.com/?userPrincipalName?sub?(&(objectClass=person)(objectClass=user))"

for

AuthLDAPURL "ldap://server.domain.com:3268/?userPrincipalName?sub?(&(objectClass=person)(objectClass=user))" 

To distinguish users between domains, an identifier called a User Principal Name (UPN) can be added to a user's entry in the directory. This UPN usually takes the form of the user's account name, followed by the domain components of the particular domain, for example

somebody@nz.somedomain.com 

For more information about mod_authnz_ldap please see http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html

Once you are done with this, restart Apache and let's start configuring the Web interface.

Edit your file /opt/nac/web/config.inc, and adjust the following variables:

$ad_server
$ad_port
$ad_user
$ad_password
$ad_base
$ad_auth
  • ad_server: The Domain controller where the AD is queried.
  • ad_port: Make sure it matches what you have defined in your Apache main configuration file. If you are using a Global Catalog set it to 3268, 389 otherwise.
  • ad_user: This is the DN of a user with sufficient privileges to read the necessary information from AD. The possible values for this setting should be in the form 'cn=User,cn=users,dc=domain,dc=com';
  • ad_password: The password for ad_user
  • ad_base: The base DN (Distinguished Name) where users' information is stored. The possible values for this setting should be in the form 'cn=users,dc=test,dc=com'
  • ad_port: Set it to true to active AD authentication in the Web Interface, to false otherwise.

This interface reuses the credentials supplied to Apache to perform the authentication in the Web GUI.

Since this GUI has a read-only and a write-only interface, we need to define the groups who'll be using each of these interfaces. In MySQL, you modify the table guirights to define the rights associated to each group. To declare a group, you use its full DN. For example:

update guirights set ad_group='CN=FreeNAC_write,DC=domain,DC=com' where code=99;
update guirights set ad_group='CN=FreeNAC_read,DC=domain,DC=com' where code=1;

Now point your browser to your Web interface to check that it is properly working.

Monitoring

There are several monitoring scripts that need to be individually tested and enabled in root cron.

Monitor syslog for unusual events:

0 8,12  * * 1-5        /opt/nac/logcheck/logcheck.sh 

Is the Mysql the socket OK? If not restart.

7-18 * * 1-5 /opt/nac/bin/check_mysql

Are any disks full?

*/3 *     * * *    /opt/nac/bin/check_disk 90 800

These two check that a minimum number of devices are being regular allowed onto the network, and that a port is not flapping between several vlans:

30   6-22 * * 1-5 /opt/nac/bin/monitor_allows.sh
*/4 * * * * /opt/nac/bin/flap_detect

Are there any 'MAC-NOT-RECONFIRMED' from switches or vmps requests with MAC 000000 that might indicate communication problems between switches and the NAC server?

*/10 7-18 * * 1-5 /opt/nac/bin/monitor2.sh

Notify if there are updates to NAC (query FreeNAC.net)

0 0 * * 0        /opt/nac/bin/updates 

Alert if key processes die.
[Note: the proctst daemon is the main method of daemon watching]

*/20 7-18 * * 1-5 /opt/nac/bin/monitor_processes.pl proctst vmpsd_external

In 802.1x mode, check samba & free radius too.

*/20 7-18 * * 1-5 /opt/nac/bin/monitor_processes.pl winbindd smbd nmbd radiusd

AD/LDAP user interface

DESCRIPTION

The purpose of this module is to query Microsoft's Active Directory to obtain user information which is then stored in the users table. The module should also work for other LDAP implementations, although some modifications may be necessary (attribute names). Optionally additional information from the Microsoft Exchange AD schema extension can be fetched as well.

HOW DOES IT WORK

The module fetches the attributes sAMAccountName, sn (surname) and GivenName of all objects of type person underneath all Distinguished Names (dn) defined in $ad_base_user_dn as configured in config.inc. Then it checks for each account name if it exists already in the database. If it does, the entry is updated, including the LastSeenDirex field. Otherwise a new entry is inserted into the database.

In case of querying addtional MS Exchange attributes, these are:

  • department
  • mail
  • physicalDeliveryOfficeName
  • telephoneNumber
  • mobile

CONFIGURATION

There are five options in the global configuration.

  • ad_server: The Domain controller where the AD is queried.
  • ad_user: This is the DN of a user with sufficient privileges to read the necessary information from AD. The possible values for this setting should be in the form 'cn=User,cn=users,dc=domain,dc=com';
  • ad_password: The password for ad_user
  • ad_base_user_dn: The DNs (do not confuse with Domain Name Server) of the places underneath which users are stored. The possible values for this setting should be in the form 'cn=users,dc=test,dc=com'
  • ad_port: The port where we should connect to.
    There are two ports related to LDAP. The port 389 is the standard port assigned to this service and the port 3268. The port 3268 is assigned to the Global catalog. A Global Catalog is a read only copy of selected attributes of all of the Active Directory servers whithin the AD forest. Querying the Global Catalog allows all the domains to be queried in a single query, without the query spanning servers over potentially slow links. It is recommended to use the Global Catalog since it is used only for searches and port 389 is used for read and write operations, and therefore it could be restricted.

HOW TO USE IT

First, setup the AD related parameters in config.inc. IMPORTANT: Once you have set the related parameters in config.inc, you need to import the config.inc file into the database. As of release V2.2 RC2, ad_user_snyc takes all the variables from the config table, so the config.inc file has to be imported into the database.

Do the following from the /opt/nac/contrib directory:

./config2db ../etc/config.inc

If you need to redefine some of these settings, you can do so through the Windows GUI.

Then run the module script from the command line with the paramter 'test'. This checks whether your LDAP server can be reached and dumps the user information obtained to stdout. If you want to fetch the addtional MS Exchange attributes launch the module with the addtional argument 'exchange'. Once your setup works, register the module in crontab.

crontab -e

add the next line

0 0 * * *    /opt/nac/bin/ldap

or

0 0 * * *    /opt/nac/bin/ldap exchange

This will run it every day at midnight.

DEPENDENCIES

OpenNac
PHP with LDAP support

FILES

bin/ad_user_sync
etc/config.inc
doc/README.ad_user_sync

nmap port scan module

Description:

This module is provided in order to give network administrators further knowledge about the systems that are part of their network, providing information about changes that computers connected to the network have suffered.

How does it work?

It grabs some allowed IPs from the OpenNAC database (more precisely from the systems table), and passes them to nmap, which is going to perform a scan. The results of this scan are saved to an XML file which is then parsed and these results are used to populate some tables which form part of the OpenNAC inventory system. The module logs to syslog if there are discrepancies between the current scan and information stored in the database. If there are differences it logs what has changed and makes the necessary corrections to the database. The tables used by port_scan are:

  • nac_hostscanned
  • nac_openports
  • protocols
  • services
  • subnets

The tables protocols and services are lookup tables. They contain descriptions of protocols and services related to a certain port.
The table subnets contains definitions of subnetworks that port_scan is allowed to scan.
The table nac_hostscanned contains general information (IP address, hostname, OS) of scanned systems.
The table nac_openports contains information of the services present on each host which is in the nac_hostscanned table.

Dependencies:

OpenNAC
Nmap 4.11 or later

Modes of operation:

This script has 3 modes of operation:

  1. When it is called with no arguments, it grabs IPs from the systems table and compares them against the networks defined in the subnets table. The final decision on what to scan is made through the LastSeen time threshold. With this, you say to scan only the hosts that were seen on the network within the lapse of 1 day, 1 month, 30 minutes, whatever.
  2. When it is called with the "--scannow" parameter, it grabs IPs from the systems table, no matter if they are allowed or not, as long as in the systems table the flag "scannow" has the value "1". Then it checks these IPs against what you have specified in the subnets table.
  3. IPs from the command line. You can call the script with something like port_scan x1.y1.z1.w1 ... xn.yn.zn.wn. In this way, the script will get the IPs from the command line and only those IPs which fall within the criteria specified in the subnets table will be scanned.

About the subnets table and its use with port_scan:

Only those computers which fall within the criteria specified in the subnets table will become a strong candidate to be scanned. As said before, this table contains definitions of subnetworks that port_scan is allowed to scan. This was done so because maybe you have lots of subnets in your network, and some of them are behind a firewall, so they can't be accessed and scanning them would be a waste of time and resources. That's why, you need to specify in this table one register per subnet you want to take into account.

How to install:

You'll need nmap v4 or later, if you don't have it, download it from www.insecure.org/nmap, or your local package source.

Rename port_scan.inc.template to port_scan.inc

cp /opt/nac/etc/port_scan.inc.template /opt/nac/etc/port_scan.inc

and modify the configuration settings according to your needs, especially the nmap path.
Once you are happy with your settings, you need to import this configuration file into the database. As of release V2.2 RC2, port_scan takes all the variables from the config table (except for $debug_flag1), so the port_scan.inc file has to be also imported into the database.

Do the following from the /opt/nac/contrib directory:

./config2db ../etc/port_scan.inc

If you need to redefine some of these settings, you can do so through the Windows GUI.

Next, create the following directory

mkdir /opt/nac/scan

Now you need to define the networks you'd like to scan. In MySQL, do the following:

insert into subnets set ip_address='192.168.1.0', ip_netmask='24', scan='1';

This will add the subnetwork 192.168.1.0/24 to your subnets table and with 'scan=1' we are saying that this subnetwork can be scanned. You need to do this for every subnet you want to take into account.

Files and directories required:

/opt/nac/bin/port_scan
/opt/nac/etc/port_scan.inc
/opt/nac/funcs.inc
/opt/nac/scan/

How to run it:

Important: You need to specify first in the subnets table the networks you want to scan.

  • To scan all devices that are in the systems table, just type:

     /opt/nac/bin/port_scan &

  • To scan all devices in the systems table that have the flag scannow=1, do:
     /opt/nac/bin/port_scan --scannow

    With the GUI you can set the flag for devices you want to scan now.

    If you prefer do it by hand, then

    update systems set scannow=1 where ...;

  • To scan a list of IP addresses, do
    /opt/nac/bin/port_scan 192.168.0.1 192.168.0.2 192.168.0.3 ... 192.168.0.254

Add the following entries to your crontab:

# FreeNAC: port_scanning of systems
*/5 8-18 * * 1-5 /opt/nac/bin/port_scan --scannow
# Active scanning: nmap monday
0 11 * * 1 /opt/nac/bin/port_scan

The first entry runs every five minutes, and it is the main mechanism to control port_scan from the GUI. With the GUI you set the flag 'scannow=1' and then this cronjob will scan the systems which have this flag on.

The second entry scans all devices present in the systems table every Monday at 11:00 AM

Bugs:

Please report them in our Development forum:
http://www.freenac.net/phpBB2/viewforum.php?f=2

4b. Slave server initial configuration

This sections describes the specific configuration for slave servers.

Slaves, also called secondaries, are much simpler that masters. They just have a replicated MySQL database running, and a vmpsd daemon.

The slave does not communicate with GUIs, or poll routers /switches, or communicate with any external servers such as Wsus, MS-SMS or Epo.

All data in the DB is read-only, except for one local tables "vmpsauth".

MySQL configuration

Introduction

It is presumed that mysql is up and running, but that the opennac DB does not exist yet.

/etc/my.cnf settings

Copy /etc/my.cnf from your MASTER machine and adapt. The key settings for a server called "vmps2" would be as follows.

datadir=/var/lib/mysql
log-error=/var/lib/mysql/mysqld.log
log-bin=vmps2-bin
log-warnings
server-id = 20 [adapt if more than one slave]
report-host=vmps2 [adapt if more than one slave]
replicate-do-db= inventory
replicate-wild-ignore-table= inventory.vmpsauth%
relay-log=vmps2-relay-bin

It is important that server-id and report-host are unique with the group of NAC servers. So set it to "vmps3" and "30" for a third server (2ndslave) etc.

Mysqld startup

Ensure that /etc/init.d/mysql exists, and automatic start is enabled ('chkconfig mysql on').

Configuring the empty opennac DB

Empty the vmpsauth (local):
DELETE FROM vmpsauth;

Configuring the DB permissions

The DB in only accessed by local scripts, it is not used by the GUis, so permissions can be mucht tighter than on the master.

-- Set passwords for script access
-- Local PHP server script user, PASSWORD1 is set in config.inc

grant SELECT,INSERT,UPDATE ON inventory.* to inventwrite@localhost IDENTIFIED by 'PASSWORD1';
SET PASSWORD FOR inventwrite@localhost = OLD_PASSWORD('PASSWORD1');

grant SELECT,INSERT,UPDATE,DELETE ON opennac.systems to inventwrite@localhost;
grant ALL ON opennac.vmpsauth to inventwrite@localhost;

Troubleshooting

Try to start mysql:
/etc/init.d/mysql start

If you have errors, check the log:
more /mysqldata/mysqld.log

Check that mysql client works, i.e. can connect to the DB:

mysql mysql

Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 2 to server version: 5.0.21-max-log
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql>

Make sure that file permissions are right. e.g.

chown -R mysql:mysql /mysqldata/* /var/lib/mysql
chgrp -R mysql /usr/local/mysql/*

Notes

  • If the server is not exclusively used by VMPS with one administrator, you probably want to set a local root password for mysql.
    mysqladmin -u root password 'new-password'
    mysqladmin -u root -h MYHOST password 'new-password'
  • On some Suse systems it might be necessary to copy the mysql client library (for PHP) from your master
    scp /usr/lib/libmysqlclient.so.14 vmps2:/usr/lib
  • On a strictly minimal slave, you need libxml and php5 at least.
    Copy /opt/php5 /opt/libxml2 and /opt/vmps from your master
    ln -s /opt/php5/bin/php /usr/bin/php

MySQL replication

1. Introduction

This document explains how to setup MySQL replication between master and slaves.

Reference.http://dev.mysql.com/doc/refman/5.0/en/replication-howto.html

Replace the following in the examples below:

 

 SERVER2.DOMAIN       the FQDN of your slave
repl                 Replication username
REPL_PASSWD          Replication password
opennac              Name of your database (this was 'inventory' prior to NAC v2.2).

2. Master: enable replication

On the mysql prompt:

GRANT SELECT, PROCESS, FILE, SUPER, REPLICATION CLIENT, REPLICATION SLAVE ON *.* TO 'repl'@'vmps2' IDENTIFIED BY 'REPL_PASSWD';
SHOW MASTER STATUS;

Purge uneeded logs on the master:

PURGE MASTER LOGS TO 'SERVER-bin.NUMBER' 

[the exactname comes from the File field in the status above]
    

3. Re-synchronisation

We'll use "vmps2" to mean the slave, and "vmps1" to mean the master.

0) On vmps2
stop slave;

1) On the master, vmps1: Lock the tables, note log position, restart

  mysql> FLUSH TABLES WITH READ LOCK;
  vmps1:/mysqldata[11]$ tar cvf opennac.tar opennac
  mysql> SHOW MASTER STATUS;

  +------------------------+----------+--------------+------------------+
  | File                   | Position | Binlog_Do_DB | Binlog_Ignore_DB |
  +------------------------+----------+--------------+------------------+
  | vmps1-bin.000027       | 12717436 |              |                  |

  ==> take note of the position

  mysql> UNLOCK TABLES;

2) Slave vmps2:

  # stop mysql
  rcmysql stop

  # Copy DB tar file from master & extract:
   mv opennac opennac.$$
   scp vmps1:/mysql/opennac.tar .
   tar xvf opennac.tar
   chmod 770 opennac; chmod g+s opennac; chown -R mysql:mysql opennac;

  # Configure slave: start daemon with slave off
    /usr/local/mysql/bin/mysqld --user=mysql --skip-slave-start --log-warnings

  Start mysql client:
    reset slave;

  # CHANGE MASTER, replace XXXX, YYYY, ZZZZ and 'FILE_NAME':

CHANGE MASTER TO MASTER_HOST='XXXX', MASTER_USER='repl',
  MASTER_PASSWORD='YYYY', MASTER_LOG_FILE='FILE_NAME', MASTER_LOG_POS=ZZZ;

 
  # Start replication:

    START SLAVE;
    show slave status \G;

  # Check the log position with that on the master:

    show master status;

  ### Create a new vmpsauth table, which is the only local table:
    CREATE TABLE opennac.`vmpsauth` ( `mac` varchar(30) NOT NULL default '', `AuthLast` datetime default NULL, `AuthPort` varchar(20) default NULL, `AuthSw` varchar(20) default NULL, `vlan_group` int(11) default NULL, `AuthVlan` int(11) default NULL, PRIMARY KEY (`mac`) ) ENGINE=MyISAM DEFAULT CHARSET=latin1 COMMENT='List of VMPS authenticated Computers' ;

  # Also check the slave mysql log for errors.

  # If all looks fine, stop the slave and start it normally:
    /etc/init.d/mysql stop
    /etc/init.d/mysql start

  # If vmps is configured, restart that too:
    /etc/init.d/vmps start

    tail -f /var/log/messages | grep vmpsd_external

3. Fixing a replication problem

It has happened to us that replication stops due to an invalid query.
Replication is OK if

   show slave status \G;

Shows the master log position  correct, Slave_IO_Running: Yes and Slave_SQL_Running: Yes.

For eaxmple, lets say Slave_SQL_Running was 'No', so we fix it, by stopping the
slave and skipping the SQL Query causing the problem:

  stop slave;
  SET GLOBAL SQL_SLAVE_SKIP_COUNTER=1;
  start slave;
  show slave status \G;
 
It now skips to the next error:
  Slave_SQL_Running: No
  Last_Error: Error 'Unknown table 'opennac.v_1'' on query. Default database: 'opennac'. Query: 'DROP   VIEW v_1'

To get through these difficult queries, it may be necessary to repeat the above.
 
[Note: I don't why drop views failed in the above example, seems to be a MySQL5 issue]
More reading:
  http://dev.mysql.com/doc/refman/5.0/en/set-global-sql-slave-skip-counter...
  http://dev.mysql.com/doc/refman/5.1/en/replication-options.html

4. Monitoring replication

Install monitor_mysql_slave and call it from cron on the slave:

*/5  7-18 * * 1-5 /opt/nac/bin/monitor_mysql_slave

 

Monitoring

When tests show that everything is working, enable CRON entries for process monitoring and to restart SQL weekly:

## Vmps secondary:
0   1    * * 6    /sbin/rcsyslog restart|logger; /etc/init.d/mysql restart|logger; /etc/init.d/vmps restart|logger;

# Monitoring:
*/20 7-18 * * 1-5 /secure/monitor_processes.pl proctst vmpsd_external mysqld_safe

[NOTE: To do: the /secure paths are wrong, update with /opt/nac bin and test these instructions]
Enable "Proctst" to automatically re-start a dameon if it dies:
  Copy from master:
    scp /opt/nac/bin/proctst* vmps2:/secure
    scp /etc/proctst.conf vmps2:/etc
        
  Configure on slave:
    vi /etc/proctst.conf   [enable entries for "vmps2"]
    
    vi /etc/init.d/proctst   [remove the vmps_lastseen dependancy in the header]
 
    ln -s /secure/proctst /etc/init.d/proctst
    ln -s /secure/proctst /sbin/rcproctst
    chkconfig proctst on
    /etc/init.d/proctst start

    tail nohup.out

Check sylsog messages

Try stopping a daemon such as postfix and make sure its auto started and an email generated.

 

Vmps daemon installation

Now we get the vmps daemon going.

cp /opt/nac/contrib/init.d/vmps /etc/init.d
ln -s /etc/init.d/vmps /usr/sbin/rcvmps
chmod 750 /etc/init.d/vmps

vi /etc/init.d/vmps [adapt IP address on vmpsd start line]

Start and watch syslog for events:
/etc/init.d/vmps start

Check the syslog:
tail -f /var/log/messages | grep vmpsd

If there are errors, first try to start /opt/nac/bin/vmpsd_external manually.

If everything looks good, enable VMPS to start after a reboot:
chkconfig vmps on

5. Install the Windows Interface

Installation

  1. Download the Windows GUI (vmps.exe and vmps.xml) and save a copy to a folders, for example called FreeNAC.
  2. The GUI configuration file is vmps.xml, open this is your favourite text editor (vi, notepad, ...)

Configuration: NAC server IP address and Database name

  1. Configure vmps.xml and set the 'mysql server' parameter to the IP address of the the NAC master server.
  2. By default, the GUI expects to connect to the 'opennac' dataset, which is initially empty an will be used to when FreeNAC talks to switches and routers in your environment. To select this database, no changes are needed to vmps.xnl.
  3. There is also a sample database "nacdemo" (in the contrib directory), if you wish the GUI to point to this:
    • Configure vmps.xml and set the 'mysql database' to 'nacdemo'.

Configuration: GUI user rights

There are two levels of authentication/authorisation:
A. MySQL authentication & authorisation: the windows GUI uses a specific user & password to connect to the DB. We call this the 'mysql user'
B. Windows GUI identification and authorisation: the GUI takes your currently windows logged-in user to identify you, and uses the value in the nac_rights field for this user to control what you can do (client-side enforcement). we call this the 'NAC user'

A. MySQL user

The MySQL user is created in mysql and given rights to access certain tables remotely. This users is usually called 'inventwrite' (for historical reasons) and is granted access in mysql (as root) with commands like the following (see the MySQL section in the Master Server installation installation chapter).

Note that the password is set to 'PASSWORD1' below, adapt as necessary.

CREATE USER 'inventwrite'@'%' IDENTIFIED BY 'PASSWORD1';
grant SELECT,INSERT ON opennac.* to inventwrite@'%';
SET PASSWORD FOR inventwrite@'%' = OLD_PASSWORD('PASSWORD1');
grant SELECT,UPDATE ON opennac.oper to inventwrite@'%' ;
grant SELECT,UPDATE ON opennac.config to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.building to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.location to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.port to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.switch to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.vlan to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.systems to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.users to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.patchcable to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.vlanswitch to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.cabletype to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_class to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_class2 to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os1 to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os2 to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os3 to inventwrite@'%';
FLUSH PRIVILEGES ; 

To verify that the inventwrite user exists:

 select * from user where user="inventwrite"'

 

Next, inform the windows GUI about which username/password it should use. The username and password is stored in an encrypted string called 'auth' in the vmps.xml configuration file.

      a) Starting the GUI vmps.exe       b) Admin -> Encrypt User       c) Fill in the Username and Password, and click on Generate       d) Copy the value of the 'generated key' filed to the 'auth' field in vmps.xml       e) quit the GUI 

B. NACuser

The GUI takes your currently windows logged-in user to identify you, to the server. It also sends the Windows domain to the server too.

So the windows username must also exist in the NAC user table, and the user must also have a permission value set. The permission is a value access to the nac_rights field and it can have three values (1=readonly, 2=write, 99=administrator).

Next, an SQL example to add a user called 'smith' to the users table, with administrator permissions:

 insert into users (username, Surname, GivenName, nac_rights) values ('jsmith', 'John', 'Smith', 99);

Once users have been added, their permissions and other details change be changed in the GUI itself. (Administration -> Users).

Demo mode:

For demonstration puurposes, there is a 'demo mode' which is enabled if the field 'DemoMode' is set to '1' in the config table on the server.

If DemoMode is=1, and the DEMO company is set in vmps.xml, then all Windows users are given administrator access, which is fine for initial testing, but must be changed afterwards.

To disable, do the following as root on the MySQL prompt:

update config set value='0' WHERE name='DemoMode';  

Verification of the windows domain

Using the NAC Windows GUI

Start the GUI and press 'connect'.

See the Users Guide (http://freenac.net/en/community?q=en/usersguide) for a description of how to use the Windows interface.

6. Switch configuration

Please refer to the FreeNAC Technical Guide (http://freenac.net/en/techguide).

Learning mode

Starting with a test switch on specific ports, NAC is enabled by configuring ports to use dynamic vlan assignment (“switchport access vlan dynamic” in IOS).

The switch performs a VLAN assignment requests for each new connection and will regularly re-confirm existing connections.

  1. If the MAC Address of the connecting system is in the database, the switch will assign the attributed VLAN.
  2. If the MAC Address of the connecting system is not in the database, meaning that this is an unknown system (new, unmanaged or something else), the switch will assign the default vlan.
    The MAC Address will also be inserted into the NAC database so that it can be later edited and activated.

During this learning mode, all ports are open to all hosts. This is meant to avoid disrupting the network during the initialisation of the NAC service.

As noted above, new MAC addresses will be inserted into the database as unknown hosts. The NAC system will auto-discover the IP & DNS names of these systems (via the router_ipprogram called from cron).

The NAC administrator(s) or the super-users, will need to edit those hosts in the NAC and designate their VLAN and optionally document the end-device details and assign it to a user.

Notes

If at first you don't succeed, persevere :-) ... check the troubleshooting section of the FreeNAC User Guide notes, then search/ask questions in the Forums.

We are working hard on FreeNAC, so considering get the latest snapshot from subversion (SVN) once you're running. 

 

Troubleshooting

See the users guide http://freenac.net/en/community?q=en/usersguide