There are three key documents available on http://FreeNAC.net/en/community, the User's, Technical and Installation Guide. FreeNAC administrators will need to read all three. Each is divided into several subpages, if you wish to see it all on one page, click the "Printer-friendly version" link below.
This document describes how to get FreeNAC installed.
A nice, complete step-by-step installation guide for FreeNAC v2.1 and Suse v10 has also been contributed in Word format, see http://opennac.svn.sourceforge.net/viewvc/*checkout*/opennac/branches/2.... . It it limited to the older v2.1 though, and Suse specific.
This document aims to bring similar information, more uptodate.
To run FreeNAC, you'll need
Example: a site running with ~2'000 active end-devices. The server is rarely loaded (CPU or I/O). The slowest part is the Windows GUI with its complex SQL queries - not the VMPS back-end.
Its recommended to have at least 2, and perhaps 3 servers. If you are used to Virtual Machines, do the Master as a VM, and one or more replicas as 'real' machines. Point the switches at the replicas, and use the master for serving GUI requests, scanning and polling switches/routers and processing syslogs.
By doing the master as a VM, snapshots can be used before system upgrades, and roll backs are easier.
To get FreeNAC up and running, either a physical machine with GNU/Linux and FreeNAC will have to be installed, or the Linux VM downloaded. This section describes the latter approach.
FreeNAC does not run on windows.
In order to get you started quickly with FreeNAC, we have built a Virtual Appliance with Linux, the modules needed, and FreeNAC installed in a 'demo mode'.
You can download the virtual machine, and start it within VMware Workstation or the free VMware Player or Server .
There are two datasets included with the VM: "nacdemo" contains an example that should help to understand the GUI and what information freeNAC stores, whereas "opennac" is an empty dataset ready for productive use.
Optional changes to the Linux VM:
Point your switch(es) to the FreeNAC VM (see the technical Guide (http://freenac.net/en/techguide). Observe syslog and play with the GUIs.
This virtual machine includes support for 802.1x which provides for stronger security. User authentication is performed against a windows domain controller so ensure you have one in place. If you don't, you can still enjoy of a fully functional LAN Access Control since it is already configured to do so. The 802.1X default configuration is intended to allow you to authenticate users against Active Directory, and then validate devices and assign them a VLAN.
Presumably you already have a functioning Active Directory domain, and know how to run it. AD is very dependent on DNS (domain name system) so first you'll need to add an entry for your FreeNAC virtual machine in your DNS. Once you've added this entry, we need to configure kerberos.
Clock synchronization is so important in the security of the Kerberos protocol. If clocks are not synchronized within a reasonable window, Kerberos will report fatal errors and refuse to function. Clients attempting to authenticate from a machine with an inaccurate clock will be failed by the KDC in authentication attempts due to the time difference with the KDC's clock. This is why it is so important to have the clock of your virtual machine configured properly. This virtual machine is configured to use the Zurich's timezone, so if you live in a different part of the globe, you'll need to change the configuration of your timezone.
Change to the directory to /usr/share/zoneinfo, here you will find a list of time zone regions. Choose the most appropriate region, if you live in Canada or the US this directory is the "Americas" directory.
If you wish, backup the previous timezone configuration by copying it to a different location. Such as
mv /etc/localtime /etc/localtime-old
Make a symbolic link from the file with the appropiate timezone to /etc/localtime.
ln -s /usr/share/zoneinfo/Europe/Amsterdam /etc/localtime
Then, adjust the time of your virtual machine by using the command date. The syntax of the date command is 'date MMDDhhmmYYYY'. So, let's say it is January 30 2010, 13:35, you type:
date 013013352010
This will set the right time for your computer. You verify that the time is correct by typing 'date' again with no parameters.
date
and it will display the time you specified in the previous step.
The Network Time Protocol (NTP) is available for the time synchronization of servers. Add an entry in your crontab to synchronize the clock of your virtual machine with an external time source.
crontab -e
A text editor will appear with some entries in it. The existent entries are required for the proper functioning of FreeNAC. Add the next entry at the beggining of the file:
#Time synchronization
0 0 * * * /usr/sbin/ntpdate server > /dev/null 2>&1
Save your changes. This entry will synchronize every midnight your VM's clock with the one of server.
Next, set the hardware clock. Do this by
hwclock --systohc
Then, restart your VM.
Once it is up again, we need to modify the configuration files for Kerberos to work.
Edit /etc/krb5.conf. The provided krb5.conf file is as follows:
[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_real = false
dns_lookup_kdc = false
[realms]
DOMAIN.COM = {
default_domain = domain.com
kdc = ad.domain.com
admin_server = ad.domain.com
}
[logging]
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log
default = FILE:/var/log/krb5lib.log
Modify the lines
default_realm = DOMAIN.COM
DOMAIN.COM = {
default_domain = domain.com
And change domain.com for your domain. Mind the case.
For the lines
kdc = ad.domain.com
admin_server = ad.domain.com
You specifiy your Active Directory domain server.
Save your changes, and then check that you get no error from typing
kinit Administrator
It'll request you for the Administrator password to create a ticket in your system.
If you get errors, check again your /etc/krb5.conf file.
Even if your DNS servers are perfect in every way, it is a good idea to add important servers to your local /etc/hosts file. It speeds up lookups and provides a fallback in case the DNS servers go down. So, add the entry for your Active Directory domain server in /etc/hosts.
Sample:
192.168.1.1 ad.domain.com ad
Once you have this part working, let's configure Samba.
Modify the file /opt/samba/lib/smb.conf. The provided smb.conf file is as follows:
[global]
workgroup = domain
security = ads
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
template shell = /bin/bash
winbind use default domain = no
password server = ads.domain.com
realm = domain.com
[homes]
comment = Home Directories
browseable = No
writable = yes
Modify the lines
workgroup = domain
password server = ads.domain.com
realm = domain.com
With the appropiate values for your domain. Start Samba
/etc/init.d/smbd start
Verify that it started
ps uax ¦ grep smbd
And check for errors in /opt/samba/var/log.smbd. If errors are present, check again your sbm.conf file. Once Samba has started correctly, do:
net join
This will join your VM to the domain. You can verify that your computer has joined the domain by typing
klist
This should display valid Kerberos tickets and one of those is from your Active Directory domain server.
Now, start winbind
/etc/init.d/winbindd start
Verify that windbind is working. This command pulls a list of users from AD
wbinfo -u
And check for errors in /opt/samba/var/log.winbindd. If it started successfully, it will create another log file called log.wb-DOMAIN.
Once we have winbindd running, let's activate both smbd and winbindd as a service, so next time you restart your VM they'll be started automatically
chkconfig smbd on
chkconfig winbindd on
We have done all this just to get ntlm_auth running.
Now, let's try to auth with NTLM
ntlm_auth --request-nt-key --domain=domain.com --username=Administrator
password:
NT_STATUS_OK: Success (0x0)
This success message indicates that Samba is properly configured to authenticate users using AD, which is what we need for FreeRadius.
Now, let's configure FreeRadius.
Modify the file /usr/local/etc/raddb/clients.conf and add the switches you want to talk to this Radius server. Don't forget to specify the shared secret between this Radius server and your switch. In this configuration there are plenty of examples of how to define an entry for this file. You need to specify these entries in this file, otherwise the Radius server will ignore the incoming requests.
Another configuration file that you may modify is the /usr/local/etc/raddb/eap.conf. The certificates defined in this file are the ones provided by FreeRadius. These certificates are not intended to be used in a production environment. You will need to create your own certificates later on. If you only want to perform test, these will work.
The /usr/local/etc/raddb/radiusd.conf file is the main configuration file. This file will authenticate the username against your AD through ntlm_auth and then will authenticate the device and will assign a VLAN to it through the perl script /opt/nac/bin/rad2vmps. You don't need to modify anything. It is all set to start working right away.
Now, run
/etc/init.d/radius debug
If you get at the end of all the text the line:
Ready to process requests.
Your FreeRadius server is properly running. Now, press Ctrl+C to interrupt it, and activate the service
chkconfig radius on
And start the daemon
/etc/init.d/radius start
The configuration regarding your VM is finished. You only need to configure your switches to speak 802.1X to your FreeRadius and enable 802.1x in your computers.
If you have further questions, problems or comments, please post them in our forum.
This section describes how to install Linux and the components needed for NAC.
The steps involved are:
Once linux is installed, FreeNAC also needs to be installed, and the key components (FreeTDS, freeradius, Apache, PHP, MySQL) & FreeNAC configured.
Linux required packages: ncurses-devel gcc-c++ gd-devel freetype2-devel zlib-devel libpng-devel libjpeg-devel net-snmp net-snmp-devel tcpd-devel rpm-devel
openssl openssl-devel openldap2-devel graphviz
Linux key components: mysql-client mysql-server libxml samba apache php5
Additional components: freeradius, freetds.
Optional, but useful packages: traceroute, whois.
This section describes Suse (version 9.3) specific commands.
Packages to install: rcs xntp sharutils tcpdump iptraf whois nmap automake gcc ethereal rsync lynx links pin scanlogd rsync uudeview ltrace smartmontools zip unzip pcre net-snmp ntop arpwatch perl-dbi flex pytn python-dev
a) via the nework
Yast -> Network services -> proxy
http://YOUR.PROXY.COM:80/
Set Patch source 9.x in Switzerland
http://mirror.switch.ch/ftp/mirror/SuSE/suse/
Install source 9.x:
http://sunsite.cnlab-switch.ch//ftp/mirror/suse/suse/i386/9.3/
sunsite.cnlab-switch.ch /ftp/mirror/suse/suse/i386/9.3/
yast -i
yast online_update
b) or, if you have no internet access,
by downloading the Suse 9.3 ISO images to /opt/install/suse9.3
and then mounting/unmounting a CD as needed:
umount /mnt/cd
mount -o loop -t iso9660 /opt/install/suse9.3/cd1.iso /mnt/cd
In Yast, set the install source to the local directory "/mnt/cd".
Create /etc/mods (documentation of system changes)
/etc/hosts : timehost, loghost, mailhost
rcSuSEfirewall2 stop
chkconfig SuSEfirewall2 off
chkconfig SuSEfirewall2_init off
chkconfig SuSEfirewall2_setup off
rcportmap stop
chkconfig nfs off
chkconfig nfsboot off
chkconfig portmap off
chkconfig mdnsd off
rcmdnsd stop
## optional
vi /etc/snmpd.conf [enable a read-only community if you want SNMP monitoring]
rcsnmpd start
chkconfig snmpd on
Disable powersaving on servers and especially VMs:
/etc/sysconfig/powersave/cpufreq
POWERSAVE_CPUFREQD_MODULE="off"
Email
Yast -> Network services -> mail transfer agent
Outgoing mail server = [YOUR_OUTBOUND_SERVER]
vi /etc/aliases, and set "root" alias to the sysadmin
newaliases
Test email:
echo test | mailx -s "test" root
Time sync
cp /etc/localtime /etc/localtime.orig
cp /usr/share/zoneinfo/Europe/Zurich /etc/localtime [Switzerland]
cron:
0,30 7-20 * * 1-5 /usr/sbin/ntpdate -s A.B.C.D X.Y.Z.Z; /sbin/hwclock --systohc
Setup syslog for centralised logging to the master server:
In /etc/hosts, add an entry for each NAC server
XX vmps1
YY vmps2
On the Master, enable the syslog server:
vi /etc/syslog-ng/syslog-ng.conf.in
# uncomment to process log messages from network:
#
udp(ip("0.0.0.0") port(514));
SuSEconfig
rcsyslog restart
Slave: syslog client:
/etc/syslog-ng/syslog-ng.conf.in
## Forward *.info to loghost
filter f_info { level(info) ; };
destination network { udp("loghost" port(514)); };
log { source(src); filter(f_info); destination(network); };
add loghost to the vmps2 line in /etc/hosts
SuSEconfig
rcsyslog restart
change the root GECOS field in /etc/passwd to "root MACHINE"
Also check: /root/.ssh/authorized_keys
naming:
vi /etc/resolv.conf
If you use DNS domains with ".local", then replace dns library since Suse
does not like domains ending int ".local". Backup libresolv.so.2 and create a new /lib/libresolv.so.2.orig that is not so brain dead:
cd /lib cp libresolv.so.2 libresolv.so.2.orig
cat libresolv.so.2.orig |sed 's/local/lokal/g' > libresolv.so.2.NO_LOCAL
cp libresolv.so.2.NO_LOCAL libresolv.so.2
If SSH logins seem very slow, you might have to replace LOCAL with 127.0.0.1 in /etc/hosts.allow for the sshd entry.
create /secure check_disk, monitor_processes, secure.conf
ln -s /usr/bin/perl /bin/perl
Environment
copy /etc/profile.local from another machine
. /etc/profile.local
Setup filewatch
mkdir -p /var/filewatcher/archive
copy /usr/local/bin/filewatcher from another machine
copy /etc/filewatcher.conf from another machine
filewatcher -c /etc/filewatcher.conf
Setup Cron entry:
2 6-18 * * 1-5 /usr/local/bin/filewatcher -c /etc/filewatcher.conf
check_disk in root cron
*/3 * * * * /secure/check_disk 90 800
For the Ubuntu VM, we have used used the image "Alternate Desktop CD" from the 6.06 LTS version, which you can download from the Ubuntu website. This version doesn't include the Live CD, instead it uses a text-based installer.
We installed the LAMP server that comes with Ubuntu. This will install Apache2, MySQL5 and PHP5.
Modify the instalation sources by uncommenting the lines starting with deb from the /etc/apt/sources.list file and comment out the lines with deb cdrom
sudo vi /etc/apt/sources.list
sudo apt-get update
And then upgrade the existing packages
sudo apt-get upgrade
[Optional] Edit the file /boot/grub/menu.lst and add the following
vga=773
at the end of the line "kernel" in the section where you running kernel is and reboot the server. This will give you more lines in your console, so you won't be constrained to a 80x25 lines resolution.
In Ubuntu, to install a package, you do it with
sudo apt-get install PACKAGE
where PACKAGE is the name of the package to install.
As part of the FreeNAC installation, the following packages require to be installed:
The following packages, are optional:
Create the file /etc/mods where you'll store the changes made to your system
sudo touch /etc/mods
Add in /etc/hosts definitions for timehost, loghost and mailhost
In the file /etc/aliases there should be an alias for root. Usually the user that receives mail for root is freenac. Test email:
echo test | mailx -s "test" root
The freenac user should receive a test email
From the installation, you should have set your time zone properly. In case you haven't, copy from the /usr/share/zoneinfo directory the file that best suits your timezone.
In our case:
cp /etc/localtime /etc/localtime.orig (create a backup of the original timezone)
cp /usr/share/zoneinfo/Europe/Zurich /etc/localtime (Timezone of Switzerland)
And adjust your crontab to update the current time from an NTP server
#Entry in cron
0,30 7-20 * * 1-5 /usr/sbin/ntpdate -s A.B.C.D X.Y.Z.Z; /sbin/hwclock --systohc
where A.B.C.D X.Y.Z.Z are NTP servers to synchronize from.
Change the root GECOS field in /etc/passwd to "root MACHINE"
Also check: /root/.ssh/authorized_keys
This document explains how to compile key components from source, if needed. It is recommended to use the packages that are included with your distribution if possible, since automated updates will be easier.
It was last updated in Mar'07, and refers to versions available on that date.
You'll need to download the packages, always use the latest releases, the following are example URLs.
http://mirror.switch.ch/ftp/mirror/apache/dist/httpd/httpd-2.2.2.tar.gz
http://mirror.switch.ch/ftp/mirror/mysql/Downloads/MySQL-5.0/mysql-5.0.2...
ftp://fr.rpmfind.net/pub/libxml/libxml2-2.6.23.tar.gz
http://www.ibiblio.org/pub/Linux/ALPHA/freetds/stable/release_candidates...
http://ch2.php.net/get/php-5.2.0.tar.bz2/from/this/mirror
cd /opt/install
tar xvzf httpd-2.2.2.tar.gz
cd httpd-2.2.2
./configure --prefix=/usr/local/apache2 --enable-so
make install
ln -s /usr/local/apache2 /usr/local/apache
ln -s /usr/local/apache2/bin/apachectl /etc/init.d/apache2
ln -s /usr/local/apache2/bin/apachectl /sbin/rcapache2
# Actually start apache if you intend using the web interfaces, see below:
chkconfig apache2 on
/etc/init.d/apache2 start
Prerequisites: ncurses-devel gcc-c++
cd /opt/install
tar xvzf mysql-5.0.27.tar.gz
cd mysql-5.0.27
./configure --prefix=/usr/local/mysql-5.0.27 --localstatedir=/mysqldata --with-unix-socket-path=/var/lib/mysql/mysql.sock
make install
cd /usr/local
mv mysql mysql.$$ [in case you have a link already]
ln -s mysql-5.0.27 mysql
ln -s /usr/local/mysql/bin/mysqld_safe /usr/local/mysql/bin/mysql
Create a mysql user:
groupadd mysql
useradd -g mysql mysql
Create an empty database:
cd /usr/local/mysql
bin/mysql_install_db --user=mysql
mv data /var/lib/mysql
ln -s /var/lib/mysql data
ln -s /var/lib/mysql /mysqldata
ln -s /var/lib/mysql/mysql.sock /tmp/mysql.sock
Set permissions:
chown -R mysql:mysql /mysqldata /var/lib/mysql
cd /opt/install
tar xvzf libxml2-2.6.24.tar.gz
cd libxml2-2.6.24/
./configure --prefix=/opt/libxml2 && make install
If you need to access MS-SQL or Sybase Enterprise databases.
cd /opt/install
wget http://www.ibiblio.org/pub/Linux/ALPHA/freetds/stable/release_candidates...
tar xvzf freetds-0.64RC2.tar.gz
cd freetds-0.64RC2
./configure --prefix=/opt/freetds --enable-msdblib
make install
vi /opt/freetds/etc/freetds.conf and add a definition to a DB to test:
[sms] <-- alias name
host = MyServer.mydomain.com <-- sever name/IP
port = 1433
tds version = 4.2
dump file = /var/log/freetds.log
dump file append = yes
#debug level = 10
debug level = 3
Try connectivity:
/opt/freetds/bin/tsql -S [alias] -U [user] -P [password]
Install first the prerequisites packages, PHP is built with many options enabled: gd-devel freetype2-devel zlib-devel libpng-devel libjpeg-devel
net-snmp net-snmp-devel tcpd-devel rpm-devel
openssl openssl-devel openldap2-devel graphviz
cd /opt/install;
tar xBf php-5.2.0.tar.bz2
cd php-5.2.0
## If you need MS-SQL (its best to assume you do - FreeTDS was compiled above)
./configure --with-apxs2=/usr/local/apache2/bin/apxs --with-mysql=/usr/local/mysql --with-mysql-sock=/var/lib/mysql/mysql.sock --prefix=/opt/php-5.2.0 --with-xml --with-libxml-dir=/opt/libxml2 --enable-pcntl --enable-force-cgi-redirect --with-mssql=/opt/freetds --with-gd --with-zlib-dir --with-ttf --with-freetype-dir --with-snmp=/usr --enable-ucd-snmp-hack --with-ldap
make install
Disable any current php binaries, and enable the new ones:
mv /usr/bin/php /usr/bin/php.$$
mv /opt/php5 /opt/php5.$$
ln -s /opt/php-5.2.0 /opt/php5
ln -s /opt/php5/bin/php /usr/bin/php
Test PHP:
php -v
Note:
Enable PHP in apache:
Edit your httpd.conf (e.g. /usr/local/apache/conf/httpd.conf) to load the PHP module
LoadModule php5_module modules/libphp5.so
The path on the right hand side of the LoadModule statement must point to the path of the PHP module on your system. Then "make install" from above may have already added this for you, but be sure to check. Also, tell Apache to parse certain extensions as PHP in httpd.conf
AddType application/x-httpd-php .php .phtml
AddType application/x-httpd-php-source .phps
This section describes how to configure FreeRadius to authenticate users in Active Directory or using certificates.
To authenticate users in Active Directory, make sure you have the following installed in your system:
Create or modify the file smb.conf to include the following minimum configuration (change for your Windows environment)
[global]
workgroup = domain
security = ads
idmap uid = 16777216-33554431
idmap gid = 16777216-33554431
template shell = /bin/bash
winbind use default domain = no
password server = ads.domain.com
realm = domain.com
[homes]
comment = Home Directories
browseable = No
writable = yes
Presumably you already have a functioning Active Directory domain, and know how to run it. AD is very dependent on DNS (domain name system) so first you'll need to add an entry for your server in your DNS.
Once you've added this entry, we need to configure kerberos. Edit the file krb5.conf and add in the realms section info concerning your domain.
Your krb5.conf file should look like
[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_real = false
dns_lookup_kdc = false
[realms]
DOMAIN.COM = {
default_domain = domain.com
kdc = ads.domain.com
admin_server = ads.domain.com
}
[logging]
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmin.log
default = FILE:/var/log/krb5lib.log
Modify the lines
default_realm = DOMAIN.COM
DOMAIN.COM = {
default_domain = domain.com
And change domain.com for your domain. Mind the case.
For the lines
kdc = ad.domain.com
admin_server = ad.domain.com
You specifiy your Active Directory domain server.
Clock synchronization is so important in the security of the Kerberos protocol.
If clocks are not synchronized within a reasonable window, Kerberos will report fatal errors and refuse to function.
Clients attempting to authenticate from a machine with an inaccurate clock will be failed by the KDC in authentication attempts due to the time difference with the KDC's clock.
Ensure you have your clock properly configured. If you want to use an external source to synchronize your server use ntp.
The Network Time Protocol (NTP) is available for the time synchronization of servers.
Add an entry in your crontab to synchronize the clock of your computer with an external time source adding the next entry.
#Time synchronization
0 0 * * * /usr/sbin/ntpdate server > /dev/null 2>&1
Save your changes. This entry will synchronize every midnight your clock with the one of server.
Even if your DNS servers are perfect in every way, it is a good idea to add important servers to your local /etc/hosts file. It speeds up lookups and provides a fallback in case the DNS servers go down. So, add the entry for your Active Directory domain server in /etc/hosts.
192.168.1.1 ad.domain.com ad
Check that you get no error from typing
kinit Administrator
This will ask you for the administrator's password. Make sure you know it beforehand.
Possible causes of error are:
Edit the file /etc/nsswitch.conf and add winbind at the end of the following lines:
passwd:
group:
protocols:
services:
netgroup:
automount:
If everything went ok, start Samba and verify that it started. Check for errors in the Samba log. If errors are present, check again your smb.conf file. Once Samba has started correctly, do:
net join
This will join you to the domain. You can verify that your computer has joined the domain by typing
klist
This should display valid Kerberos tickets and one of those is from your Active Directory domain server.
Now, change the group that the lock winbindd_privileged belongs to
chgrp radiusd /opt/samba/var/locks/winbindd_privileged
This is done because we'll run freeradius as the radiusd user, and this user needs to access this lock in order to perform the authentication against the Windows Domain
Now change its permissions
chmod 750 /opt/samba/var/locks/winbindd_privileged
And start winbind
/etc/init.d/winbindd start
Verify that windbind is working. This command pulls a list of users from AD
wbinfo -u
And check for errors in the winbindd log. If it started successfully, it will create another log file called log.wb-DOMAIN. Once we have winbindd running, activate both smbd and winbindd as services if they are not already activated.
All this has been done in order to get ntlm_auth to run. Try to auth with NTLM
ntlm_auth --request-nt-key --domain=domain.com --username=Administrator
password:
NT_STATUS_OK: Success (0x0)
This success message indicates that Samba is properly configured to authenticate users against AD, which is what we need for FreeRadius.
Configure the known access points in FreeRadius
mv /usr/local/etc/raddb/clients.conf /usr/local/etc/raddb/clients.conf.$$
cp /opt/nac/contrib/freeradius/etc/raddb/clients.conf /usr/local/etc/raddb/clients.conf
Then, edit /usr/local/etc/raddb/clients.conf to include the NAS (switches or APs) that will contact our Freeradius server; change ip addresses and PASSWORD1/2/3
Configure the /usr/local/etc/raddb/radiusd.conf file, this example uses Windows logon
mv /usr/local/etc/raddb/radiusd.conf /usr/local/etc/raddb/radiusd.conf.$$
cp /opt/nac/contrib/freeradius/etc/raddb/radiusd.conf.winlogon+macauthbypass /usr/local/etc/raddb/radiusd.conf
Another configuration file that you may modify is /usr/local/etc/raddb/eap.conf. The certificates defined in this file are the ones provided by FreeRadius. These certificates are not intended to be used in a production environment. You will need to create your own certificates later on. If you only want to perform test, these will work. If you want to generate your own certificates, please see http://freenacweb.vptt.ch/en/node/278 which contains information about how to generate certificates for your FreeRadius server if you have a Windows CA.
Start radius in debug mode to see if there are errors
radiusd -xX
If you get at the end the line:
Ready to process requests.
Then you are done. You are reading to authenticate users in the windows domain and validate devices.
This sections describes the instllation of the master server components.
Start by downloading the latest stable release nac tarball from FreeNac.net, copying to /opt, and extracting it into /opt/nac. Or, checking out directly from Subversion.
mkdir /opt/nac
svn co https://opennac.svn.sourceforge.net/svnroot/opennac/branches/2.2 /opt/nac
Ensure that mysql starts automatically (e.g. 'chkconfig mysql on' on RedHat/Suse systems).
Add the path to 'mysql' to your PATH for ease of use.
Set a softlink "/mysqldata" to point to the mysql database directory, for example '/var/lib/mysql'. In most of the documentation we refer to /mysqldata for brevity.
ln -s /var/lib/mysql /mysqldata
my.cnf
Compare your /etc/my.cnf with /opt/nac/contrib/etc/my.cnf, for paramters that may need to be set.
e.g. Adapt log-bin and report-host to include hostname:
log-bin=vmps1-bin
report-host= vmps1
Ensure the mysql user can write to the database files.
chown -R mysql /mysqldata /var/lib/mysql
Change the mysql 'root' password, if the server is multi-user (not restricte to one or two trusted administrators).
Install an initial set of empty FreeNAC tables for the 'opennac' database, backing up the existing tables first:
cd /mysqldata
cp opennac opennac.$$
cp /opt/nac/contrib/opennac_db.tar.gz .
tar xvzf opennac_db.tar.gz
mysql opennac < tables.sql
mysql opennac < values.sql
Start mysql:
/etc/init.d/mysql start
check /mysqldata/localhost.err for errors.
Login to sql and look at a few tables, they should exist, but be empty:
mysql opennac
show tables;
select * from ports;
There are 4 mysql users needed for accessing the database.
A. Local daemon user for PHP scripts: inventwrite@localhost
B. A user for the remote Delphi Windows GUI: inventwrite@'%'
C. Root is used by the sysadmin for local configuration. By default root
is only allowed from localhost, and has no password. Its is
recommended that you set a root password for mysql root, if the NAC
server login is accessible to several users.
D. The Web1 GUI has a specific user%localhost, by default called "readonly".
E. The Web2 GUI has a specific user%localhost, by default called "webwrite".
Local daemon user for PHP scripts (set the user/pw in /opt/nac/config.inc):
grant SELECT,INSERT,UPDATE ON opennac.* to inventwrite@localhost IDENTIFIED by 'PASSWORD2';
SET PASSWORD FOR inventwrite@localhost = OLD_PASSWORD('PASSWORD2');
grant SELECT,INSERT,UPDATE,DELETE ON opennac.systems to inventwrite@localhost;
grant CREATE TEMPORARY TABLES ON opennac.* to inventwrite@localhost;
grant ALL ON opennac.vmpsauth to inventwrite@localhost;
Remote delphi Windows GUI user. See also the vmps.ini file on the Windows client.
grant SELECT,INSERT ON opennac.* to inventwrite@'%' IDENTIFIED by 'PASSWORD1';
SET PASSWORD FOR inventwrite@'%' = OLD_PASSWORD('PASSWORD1');
grant SELECT,UPDATE ON opennac.oper to inventwrite@'%' ;
grant SELECT,UPDATE ON opennac.config to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.building to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.location to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.port to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.switch to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.vlan to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.systems to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.users to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.patchcable to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.vlanswitch to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.cabletype to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_class to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_class2 to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os1 to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os2 to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os3 to inventwrite@'%';
The read-only webgui Web1 needs "read" access and by default uses a user
named 'readonly'. See also /opt/nac/web1/config.inc.
grant SELECT ON opennac.* to readonly@'localhost' IDENTIFIED by 'PASSWORD1';
The webgui Web2 needs "read-write" access and by default uses a user
grant SELECT,INSERT ON opennac.* to webwrite@'localhost' IDENTIFIED by 'PASSWORD1';
SET PASSWORD FOR webwrite@'localhost' = OLD_PASSWORD('PASSWORD1');
grant SELECT,UPDATE ON opennac.systems to webwrite@'localhost' ;
grant SELECT ON opennac.users to webwrite@'localhost' ;
grant SELECT ON opennac.patchcable to webwrite@'localhost' ;
grant SELECT,UPDATE ON opennac.port to webwrite@'localhost' ;
grant SELECT ON opennac.oper to webwrite@'localhost' ;
grant SELECT ON opennac.switch to webwrite@'localhost' ;
grant SELECT ON opennac.vlan to webwrite@'localhost' ;
grant SELECT,INSERT,UPDATE ON opennac.sys_class to webwrite@'localhost' ;
grant SELECT,INSERT,UPDATE ON opennac.sys_os to webwrite@'localhost';
grant SELECT ON opennac.nac_openports to webwrite@'localhost' ;
The cron tool is where all regular tasks are done to keep the system healthy. The following are recommended regualr tasks.
Remove 'unknowns' from the DB, that were never authorised and are very old:
0 1 * * 1 /opt/nac/bin/purge_unknowns
Clean mysql logs on the 1st per month
0 6 30 * 1 /usr/local/mysql/bin/mysql -uroot -e "PURGE MASTER LOGS BEFORE DATE_SUB( NOW( ), INTERVAL 30 DAY);"
The following are scripts to backup the system in different ways to the second internal disk. These are highly system specifc, make sure you understand, tune and test them (e.g. you will need a '/disk2' partition).
0 3 * * 1-5 /opt/nac/bin/dump_ports
0 3 * * 1 /usr/local/mysql/bin/mysqlhotcopy --allowold --keepold --regexp=".+" /disk2/backups/mysql 2>&1 | logger
0 3 * * 6 rdiff-backup --exclude /media --exclude /sys --exclude /disk2 --exclude /proc --exclude /mnt --print-statistics / /disk2/backups/vmps0.rdiff;
If the NAC server is not exclusively used by one administrator, you may want to set a local root password for mysql. This make administratig more difficult though, and some cron scripts will need to be adapted to provide a password.
mysqladmin -u root password 'new-password'
mysqladmin -u root -h MYHOST password 'new-password'
The NAC server needs to have a syslog server to collect messages locally, and from any slave servers.
Its also useful, though not mandatory, for switches to send a copy of their events via syslog too.
Configure the syslog damon to listen to the network interface for messages, e.g. by starting with the "-r" option. Syslog-ng needs a directive for the network interface. Somare examples are:
A log pruning configuration file is provided with FreeNAC, review it and then activate:
cp /etc/logrotate.d/syslog /etc/logrotate.d/syslog.$$
cp /opt/nac/contrib/logrotate.d/syslog /etc/logrotate.d/syslog
Add a cron entry to prune syslog, for example on weekday mornings:
# Log pruning
0 6 * * 1-5 /usr/sbin/logrotate /etc/logrotate.conf | logger
To do:
The 'php.ini-recommended' file included in the PHP distribution, or the contrib/etc_php5_cli/php.ini of FreeNAC should be used in case of doubt.
Start by downloading the latest stable release nac tarball from FreeNac.net, copying to /opt, and extracting it into /opt/nac. Or, checking out directly from Subversion.
mkdir /opt/nac
svn co https://opennac.svn.sourceforge.net/svnroot/opennac/branches/2.2 /opt/nac
Create a config.inc from a template and set especially the DB connection parameters:
cp /opt/nac/etc/config.inc.template /opt/nac/etc/config.inc
vi /opt/nac/etc/config.inc
Once you're happy with your settings, you need to import the config file into the database. To do so:
cd /opt/nac/contrib
./config2db ../etc/config.inc
Creating a startup file and start the service:
cp /opt/nac/contrib/startup_init.d/vmps /etc/init.d/vmps
ln -s /etc/init.d/vmps /usr/sbin/rcvmps
chmod 750 /etc/init.d/vmps
chkconfig vmps on
vi /etc/init.d/vmps [adapt IP address on vmpsd start line]
Start and watch syslog for events:
rcvmps start
tail -f /var/log/messages
cp /opt/nac/contrib/startup_init.d/vmps_lastseen /etc/init.d/vmps_lastseen
ln -s /etc/init.d/vmps_lastseen /usr/sbin/rcvmps_lastseen
chmod 750 /etc/init.d/vmps_lastseen
chkconfig vmps_lastseen on
Start and watch syslog for events:
rcvmps_lastseen start
tail -f /var/log/messages
Routers can be queried regularly to discover the IP addresses attributed to MAC addresses.
Parameters to set on switches are covered in the FreeNAC Techincal Guide, 'Configuring Network Switches' chapter. http://FreeNAC.net/en/techguide
The Windows GUI has a "restart port" button that sets a flag in the database. The following script is then called from cron every minute, checking the DB for ports to restart and sending a SNMP command to the relevant switch.
Installation:
As of release 2.2 RC2, the community edition counts with the snmp_scan.php script. This script's task is to register devices' information which are currently connected to your switches. This script scans the switches which in the switch table have the flag scan=1.
Its main function is go to the switch, and by means of SNMP queries, documents information that can be helpful for a system administrator, such as:
To configure it for use, you need to first declare which switches are goind to be scanned.
update switch set scan='1' where ip='192.168.0.1';
In config.inc, modify the value of snmp_ro and snmp_rw if you haven't done so. This variables contain the SNMP communities which are used to connect to your switches.
Once you have done so, run it from the command line for testing purposes:
cd /opt/nac/bin
./snmp_scan.php
This script can take some time, depending on the number of switches of your network.
To run from crontab, add an entry as follows:
#Scanning of switches
3 11 * * 1-5 /opt/nac/bin/snmp_scan.php | logger
The Web GUI is an alternative to the Windows GUI which allows to control some parts of the FreeNAC system.
As of release v2.2 RC2, the /web interface unites both /web1 and /web2 in a single interface. In the future we'll delete both /web1 and /web2 from our repository. Also, we have done some development for the /web interface that allows to validate user credentials against Active Directory using multiple domains in order to restrict the number of users who use this /web interface.
Install Apache & libraries for graphics: this should have been done as part of your server installation, however, for completeness:
JPGraph may not be in your system's packages repository, so to install it, download the tarball from http://www.aditus.nu/jpgraph/jpdownload.php to your /opt directory. Then:
cd /opt
tar zxvf jpgraph-X.X.XX.tar.gz
ln -s jpgraph-X.X.XX jpgraph
ln -s jpgraph-X.X.XX /usr/local/share/jpgraph
[ Optional:
If you want to use the Excel export function you also need the following PEAR Module: Spreadsheet_Excel_Writer
To install Spreadsheet_Excel_Writer invoque the following command on your shell:
pear install --alldeps -f Spreadsheet_Excel_Writer
]
Create a configuration file for the web interface. Copy the file /opt/nac/web/config.inc.template to /opt/nac/web/config.inc and adjust it according to your needs.
In the /opt/nac/web/config.inc file you need to define 3 different usernames.
One for using the database (the same as in the /opt/nac/etc/config.inc file)
$dbhost="localhost";
$dbname="opennac";
$dbuser="inventwrite";
$dbpass="PASSWORD2";
Another one to use the write interface
$writeuser="webwrite";
$writepass="PASSWORD1";
and another one to use the read interface
$readuser = 'inventwrite';
$readpass = 'PASSWORD2';
We did so because maybe you want some users (desktop support) to be able to read information from the database, without actually doing modifications to it, and allow some other users (administrators) to make modifications to the systems in FreeNAC.
Change this file's permissions
chmod 640 /opt/nac/web/config.inc
And change the group this file belongs to, to the one that is used by apache to run the server. In my system, the username and group that are running my apache server are www-data, then
chgrp www-data config.inc
And change the owner of the /opt/nac/web/read/tmp directory as well
chown www-data /opt/nac/web/read/tmp
The Web GUI is located in /opt/nac/web, so we'll do a virtual directory in Apache pointing to this directory.
Locate your Apache main configuration file (it is distribution dependant) and add the definition of this virtual directory as follows:
Alias /nac /opt/nac/web
<Directory /opt/nac/web/>
Options None
Order deny,allow
Allow from all
</Directory>
<LocationMatch "\/nac.*\.inc\.*">
Deny from all
</LocationMatch>
This basic configuration doesn't restrict the use of this interface to anyone. If you want to restrict access only to a certain IP addresses, do the following:
Deny from all
Allow from 192.168.0.1 192.168.0.2
The LocationMatch stanza protects from reading all include files that you could contain within your /opt/nac/web directory. This is really important since your config.inc file, contains sensitive information such as usernames and passwords.
Make sure you have created and granted rights to the usernames that will use this interface. This is explained in the installation guide. In case you haven't done so:
#The read-only webgui needs "read" access and by default uses a user
#named 'readonly'.
grant SELECT ON opennac.* to readonly@'localhost' IDENTIFIED by 'PASSWORD1';
#The write webgui needs "read-write" access and by default uses a user
grant SELECT,INSERT ON opennac.* to webwrite@'localhost' IDENTIFIED by 'PASSWORD1';
SET PASSWORD FOR webwrite@'localhost' = OLD_PASSWORD('PASSWORD1');
grant SELECT,UPDATE ON opennac.systems to webwrite@'localhost' ;
grant SELECT ON opennac.users to webwrite@'localhost' ;
grant SELECT ON opennac.patchcable to webwrite@'localhost' ;
grant SELECT,UPDATE ON opennac.port to webwrite@'localhost' ;
grant SELECT ON opennac.oper to webwrite@'localhost' ;
grant SELECT ON opennac.switch to webwrite@'localhost' ;
grant SELECT ON opennac.vlan to webwrite@'localhost' ;
grant SELECT,INSERT,UPDATE ON opennac.sys_class to webwrite@'localhost' ;
grant SELECT,INSERT,UPDATE ON opennac.sys_os to webwrite@'localhost';
grant SELECT ON opennac.nac_openports to webwrite@'localhost' ;
Then start/restart/reload your apache server, point your web browser to http://yourserver/nac and you should see now the web interface.
To configure Apache to authenticate users against Active Directory, we'll use the module mod_authnz_ldap from Apache. Check if in the list of compiled in modules there is an entry like:
mod_authnz_ldap.c
If so, we are ready to start configuring Apache and the Web interface. If not, install this module.
In your Apache main configuration file you have already defined an entry for /nac. To perform the authentication, you need to modify that entry as follows:
Alias /nac /opt/nac/web
<Directory "/opt/nac/web/">
Options All ExecCGI -Indexes
Order deny,allow
Allow from all
AuthzLDAPAuthoritative off
AuthType Basic
AuthBasicProvider ldap
AuthUserFile /dev/null
AuthName "Sensitive Zone"
AuthLDAPBindDN cn=Administrator,cn=Users,dc=domain,dc=com
AuthLDAPBindPassword password
AuthLDAPURL "ldap://server.domain.com/?userPrincipalName?sub?(&(objectClass=person)(objectClass=user))"
require valid-user
</Directory>
<LocationMatch "\/nac.*\.inc\.*">
Deny from all
</LocationMatch>
AuthLDAPBindDN is an optional DN used to bind to the server when searching for entries. If not provided, mod_authnz_ldap will use an anonymous bind.
AuthLDAPBindPassword is a bind password to use in conjunction with the bind DN.
AuthLDAPBindDN and AuthLDAPBindDN should only be used if no anonymous bind is allowed.
AuthzLDAPAuthoritative prevents other authentication modules from authenticating the user if this one fails. Set to off if this module should let other authentication modules attempt to authenticate the user, should authentication with this module fail.
If you have more than one domain, you should be using global catalog. Global catalog uses port 3268. Global Catalog is a read only copy of selected attributes of all the Active Directory servers within the Active Directory forest. Querying the Global Catalog allows all the domains to be queried in a single query, without the query spanning servers over potentially slow links.
To use the Global Catalog, you just need to subsitute the line
AuthLDAPURL "ldap://server.domain.com/?userPrincipalName?sub?(&(objectClass=person)(objectClass=user))"
for
AuthLDAPURL "ldap://server.domain.com:3268/?userPrincipalName?sub?(&(objectClass=person)(objectClass=user))"
To distinguish users between domains, an identifier called a User Principal Name (UPN) can be added to a user's entry in the directory. This UPN usually takes the form of the user's account name, followed by the domain components of the particular domain, for example
somebody@nz.somedomain.com
For more information about mod_authnz_ldap please see http://httpd.apache.org/docs/2.2/mod/mod_authnz_ldap.html
Once you are done with this, restart Apache and let's start configuring the Web interface.
Edit your file /opt/nac/web/config.inc, and adjust the following variables:
$ad_server
$ad_port
$ad_user
$ad_password
$ad_base
$ad_auth
This interface reuses the credentials supplied to Apache to perform the authentication in the Web GUI.
Since this GUI has a read-only and a write-only interface, we need to define the groups who'll be using each of these interfaces. In MySQL, you modify the table guirights to define the rights associated to each group. To declare a group, you use its full DN. For example:
update guirights set ad_group='CN=FreeNAC_write,DC=domain,DC=com' where code=99;
update guirights set ad_group='CN=FreeNAC_read,DC=domain,DC=com' where code=1;
Now point your browser to your Web interface to check that it is properly working.
There are several monitoring scripts that need to be individually tested and enabled in root cron.
Monitor syslog for unusual events:
0 8,12 * * 1-5 /opt/nac/logcheck/logcheck.sh
Is the Mysql the socket OK? If not restart.
7-18 * * 1-5 /opt/nac/bin/check_mysql
Are any disks full?
*/3 * * * * /opt/nac/bin/check_disk 90 800
These two check that a minimum number of devices are being regular allowed onto the network, and that a port is not flapping between several vlans:
30 6-22 * * 1-5 /opt/nac/bin/monitor_allows.sh
*/4 * * * * /opt/nac/bin/flap_detect
Are there any 'MAC-NOT-RECONFIRMED' from switches or vmps requests with MAC 000000 that might indicate communication problems between switches and the NAC server?
*/10 7-18 * * 1-5 /opt/nac/bin/monitor2.sh
Notify if there are updates to NAC (query FreeNAC.net)
0 0 * * 0 /opt/nac/bin/updates
Alert if key processes die.
[Note: the proctst daemon is the main method of daemon watching]
*/20 7-18 * * 1-5 /opt/nac/bin/monitor_processes.pl proctst vmpsd_external
In 802.1x mode, check samba & free radius too.
*/20 7-18 * * 1-5 /opt/nac/bin/monitor_processes.pl winbindd smbd nmbd radiusd
The purpose of this module is to query Microsoft's Active Directory to obtain user information which is then stored in the users table. The module should also work for other LDAP implementations, although some modifications may be necessary (attribute names). Optionally additional information from the Microsoft Exchange AD schema extension can be fetched as well.
The module fetches the attributes sAMAccountName, sn (surname) and GivenName of all objects of type person underneath all Distinguished Names (dn) defined in $ad_base_user_dn as configured in config.inc. Then it checks for each account name if it exists already in the database. If it does, the entry is updated, including the LastSeenDirex field. Otherwise a new entry is inserted into the database.
In case of querying addtional MS Exchange attributes, these are:
There are five options in the global configuration.
First, setup the AD related parameters in config.inc. IMPORTANT: Once you have set the related parameters in config.inc, you need to import the config.inc file into the database. As of release V2.2 RC2, ad_user_snyc takes all the variables from the config table, so the config.inc file has to be imported into the database.
Do the following from the /opt/nac/contrib directory:
./config2db ../etc/config.inc
If you need to redefine some of these settings, you can do so through the Windows GUI.
Then run the module script from the command line with the paramter 'test'. This checks whether your LDAP server can be reached and dumps the user information obtained to stdout. If you want to fetch the addtional MS Exchange attributes launch the module with the addtional argument 'exchange'. Once your setup works, register the module in crontab.
crontab -e
add the next line
0 0 * * * /opt/nac/bin/ldap
or
0 0 * * * /opt/nac/bin/ldap exchange
This will run it every day at midnight.
OpenNac
PHP with LDAP support
bin/ad_user_sync
etc/config.inc
doc/README.ad_user_sync
This module is provided in order to give network administrators further knowledge about the systems that are part of their network, providing information about changes that computers connected to the network have suffered.
It grabs some allowed IPs from the OpenNAC database (more precisely from the systems table), and passes them to nmap, which is going to perform a scan. The results of this scan are saved to an XML file which is then parsed and these results are used to populate some tables which form part of the OpenNAC inventory system. The module logs to syslog if there are discrepancies between the current scan and information stored in the database. If there are differences it logs what has changed and makes the necessary corrections to the database. The tables used by port_scan are:
The tables protocols and services are lookup tables. They contain descriptions of protocols and services related to a certain port.
The table subnets contains definitions of subnetworks that port_scan is allowed to scan.
The table nac_hostscanned contains general information (IP address, hostname, OS) of scanned systems.
The table nac_openports contains information of the services present on each host which is in the nac_hostscanned table.
OpenNAC
Nmap 4.11 or later
This script has 3 modes of operation:
Only those computers which fall within the criteria specified in the subnets table will become a strong candidate to be scanned. As said before, this table contains definitions of subnetworks that port_scan is allowed to scan. This was done so because maybe you have lots of subnets in your network, and some of them are behind a firewall, so they can't be accessed and scanning them would be a waste of time and resources. That's why, you need to specify in this table one register per subnet you want to take into account.
You'll need nmap v4 or later, if you don't have it, download it from www.insecure.org/nmap, or your local package source.
Rename port_scan.inc.template to port_scan.inc
cp /opt/nac/etc/port_scan.inc.template /opt/nac/etc/port_scan.inc
and modify the configuration settings according to your needs, especially the nmap path.
Once you are happy with your settings, you need to import this configuration file into the database. As of release V2.2 RC2, port_scan takes all the variables from the config table (except for $debug_flag1), so the port_scan.inc file has to be also imported into the database.
Do the following from the /opt/nac/contrib directory:
./config2db ../etc/port_scan.inc
If you need to redefine some of these settings, you can do so through the Windows GUI.
Next, create the following directory
mkdir /opt/nac/scan
Now you need to define the networks you'd like to scan. In MySQL, do the following:
insert into subnets set ip_address='192.168.1.0', ip_netmask='24', scan='1';
This will add the subnetwork 192.168.1.0/24 to your subnets table and with 'scan=1' we are saying that this subnetwork can be scanned. You need to do this for every subnet you want to take into account.
/opt/nac/bin/port_scan
/opt/nac/etc/port_scan.inc
/opt/nac/funcs.inc
/opt/nac/scan/
Important: You need to specify first in the subnets table the networks you want to scan.
/opt/nac/bin/port_scan &
/opt/nac/bin/port_scan --scannow
With the GUI you can set the flag for devices you want to scan now.
If you prefer do it by hand, then
update systems set scannow=1 where ...;
/opt/nac/bin/port_scan 192.168.0.1 192.168.0.2 192.168.0.3 ... 192.168.0.254
Add the following entries to your crontab:
# FreeNAC: port_scanning of systems
*/5 8-18 * * 1-5 /opt/nac/bin/port_scan --scannow
# Active scanning: nmap monday
0 11 * * 1 /opt/nac/bin/port_scan
The first entry runs every five minutes, and it is the main mechanism to control port_scan from the GUI. With the GUI you set the flag 'scannow=1' and then this cronjob will scan the systems which have this flag on.
The second entry scans all devices present in the systems table every Monday at 11:00 AM
Please report them in our Development forum:
http://www.freenac.net/phpBB2/viewforum.php?f=2
This sections describes the specific configuration for slave servers.
Slaves, also called secondaries, are much simpler that masters. They just have a replicated MySQL database running, and a vmpsd daemon.
The slave does not communicate with GUIs, or poll routers /switches, or communicate with any external servers such as Wsus, MS-SMS or Epo.
All data in the DB is read-only, except for one local tables "vmpsauth".
It is presumed that mysql is up and running, but that the opennac DB does not exist yet.
Copy /etc/my.cnf from your MASTER machine and adapt. The key settings for a server called "vmps2" would be as follows.
datadir=/var/lib/mysql
log-error=/var/lib/mysql/mysqld.log
log-bin=vmps2-bin
log-warnings
server-id = 20 [adapt if more than one slave]
report-host=vmps2 [adapt if more than one slave]
replicate-do-db= inventory
replicate-wild-ignore-table= inventory.vmpsauth%
relay-log=vmps2-relay-bin
It is important that server-id and report-host are unique with the group of NAC servers. So set it to "vmps3" and "30" for a third server (2ndslave) etc.
Ensure that /etc/init.d/mysql exists, and automatic start is enabled ('chkconfig mysql on').
Empty the vmpsauth (local):
DELETE FROM vmpsauth;
The DB in only accessed by local scripts, it is not used by the GUis, so permissions can be mucht tighter than on the master.
-- Set passwords for script access
-- Local PHP server script user, PASSWORD1 is set in config.inc
grant SELECT,INSERT,UPDATE ON inventory.* to inventwrite@localhost IDENTIFIED by 'PASSWORD1';
SET PASSWORD FOR inventwrite@localhost = OLD_PASSWORD('PASSWORD1');
grant SELECT,INSERT,UPDATE,DELETE ON opennac.systems to inventwrite@localhost;
grant ALL ON opennac.vmpsauth to inventwrite@localhost;
Try to start mysql:
/etc/init.d/mysql start
If you have errors, check the log:
more /mysqldata/mysqld.log
Check that mysql client works, i.e. can connect to the DB:
mysql mysql
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 2 to server version: 5.0.21-max-log
Type 'help;' or '\h' for help. Type '\c' to clear the buffer.
mysql>
Make sure that file permissions are right. e.g.
chown -R mysql:mysql /mysqldata/* /var/lib/mysql
chgrp -R mysql /usr/local/mysql/*
This document explains how to setup MySQL replication between master and slaves.
Reference.http://dev.mysql.com/doc/refman/5.0/en/replication-howto.html
Replace the following in the examples below:
SERVER2.DOMAIN the FQDN of your slave
repl Replication username
REPL_PASSWD Replication password
opennac Name of your database (this was 'inventory' prior to NAC v2.2).
On the mysql prompt:
GRANT SELECT, PROCESS, FILE, SUPER, REPLICATION CLIENT, REPLICATION SLAVE ON *.* TO 'repl'@'vmps2' IDENTIFIED BY 'REPL_PASSWD';
SHOW MASTER STATUS;
Purge uneeded logs on the master:
PURGE MASTER LOGS TO 'SERVER-bin.NUMBER'
[the exactname comes from the File field in the status above]
We'll use "vmps2" to mean the slave, and "vmps1" to mean the master.
0) On vmps2
stop slave;
1) On the master, vmps1: Lock the tables, note log position, restart
mysql> FLUSH TABLES WITH READ LOCK;
vmps1:/mysqldata[11]$ tar cvf opennac.tar opennac
mysql> SHOW MASTER STATUS;
+------------------------+----------+--------------+------------------+
| File | Position | Binlog_Do_DB | Binlog_Ignore_DB |
+------------------------+----------+--------------+------------------+
| vmps1-bin.000027 | 12717436 | | |
==> take note of the position
mysql> UNLOCK TABLES;
2) Slave vmps2:
# stop mysql
rcmysql stop
# Copy DB tar file from master & extract:
mv opennac opennac.$$
scp vmps1:/mysql/opennac.tar .
tar xvf opennac.tar
chmod 770 opennac; chmod g+s opennac; chown -R mysql:mysql opennac;
# Configure slave: start daemon with slave off
/usr/local/mysql/bin/mysqld --user=mysql --skip-slave-start --log-warnings
Start mysql client:
reset slave;
# CHANGE MASTER, replace XXXX, YYYY, ZZZZ and 'FILE_NAME':
CHANGE MASTER TO MASTER_HOST='XXXX', MASTER_USER='repl',
MASTER_PASSWORD='YYYY', MASTER_LOG_FILE='FILE_NAME', MASTER_LOG_POS=ZZZ;
# Start replication:
START SLAVE;
show slave status \G;
# Check the log position with that on the master:
show master status;
### Create a new vmpsauth table, which is the only local table:
CREATE TABLE opennac.`vmpsauth` ( `mac` varchar(30) NOT NULL default '', `AuthLast` datetime default NULL, `AuthPort` varchar(20) default NULL, `AuthSw` varchar(20) default NULL, `vlan_group` int(11) default NULL, `AuthVlan` int(11) default NULL, PRIMARY KEY (`mac`) ) ENGINE=MyISAM DEFAULT CHARSET=latin1 COMMENT='List of VMPS authenticated Computers' ;
# Also check the slave mysql log for errors.
# If all looks fine, stop the slave and start it normally:
/etc/init.d/mysql stop
/etc/init.d/mysql start
# If vmps is configured, restart that too:
/etc/init.d/vmps start
tail -f /var/log/messages | grep vmpsd_external
It has happened to us that replication stops due to an invalid query.
Replication is OK if
show slave status \G;
Shows the master log position correct, Slave_IO_Running: Yes and Slave_SQL_Running: Yes.
For eaxmple, lets say Slave_SQL_Running was 'No', so we fix it, by stopping the
slave and skipping the SQL Query causing the problem:
stop slave;
SET GLOBAL SQL_SLAVE_SKIP_COUNTER=1;
start slave;
show slave status \G;
It now skips to the next error:
Slave_SQL_Running: No
Last_Error: Error 'Unknown table 'opennac.v_1'' on query. Default database: 'opennac'. Query: 'DROP VIEW v_1'
To get through these difficult queries, it may be necessary to repeat the above.
[Note: I don't why drop views failed in the above example, seems to be a MySQL5 issue]
More reading:
http://dev.mysql.com/doc/refman/5.0/en/set-global-sql-slave-skip-counter...
http://dev.mysql.com/doc/refman/5.1/en/replication-options.html
Install monitor_mysql_slave and call it from cron on the slave:
*/5 7-18 * * 1-5 /opt/nac/bin/monitor_mysql_slave
When tests show that everything is working, enable CRON entries for process monitoring and to restart SQL weekly:
## Vmps secondary:
0 1 * * 6 /sbin/rcsyslog restart|logger; /etc/init.d/mysql restart|logger; /etc/init.d/vmps restart|logger;
# Monitoring:
*/20 7-18 * * 1-5 /secure/monitor_processes.pl proctst vmpsd_external mysqld_safe
[NOTE: To do: the /secure paths are wrong, update with /opt/nac bin and test these instructions]
Enable "Proctst" to automatically re-start a dameon if it dies:
Copy from master:
scp /opt/nac/bin/proctst* vmps2:/secure
scp /etc/proctst.conf vmps2:/etc
Configure on slave:
vi /etc/proctst.conf [enable entries for "vmps2"]
vi /etc/init.d/proctst [remove the vmps_lastseen dependancy in the header]
ln -s /secure/proctst /etc/init.d/proctst
ln -s /secure/proctst /sbin/rcproctst
chkconfig proctst on
/etc/init.d/proctst start
tail nohup.out
Check sylsog messages
Try stopping a daemon such as postfix and make sure its auto started and an email generated.
Now we get the vmps daemon going.
cp /opt/nac/contrib/init.d/vmps /etc/init.d
ln -s /etc/init.d/vmps /usr/sbin/rcvmps
chmod 750 /etc/init.d/vmps
vi /etc/init.d/vmps [adapt IP address on vmpsd start line]
Start and watch syslog for events:
/etc/init.d/vmps start
Check the syslog:
tail -f /var/log/messages | grep vmpsd
If there are errors, first try to start /opt/nac/bin/vmpsd_external manually.
If everything looks good, enable VMPS to start after a reboot:
chkconfig vmps on
There are two levels of authentication/authorisation:
A. MySQL authentication & authorisation: the windows GUI uses a specific user & password to connect to the DB. We call this the 'mysql user'
B. Windows GUI identification and authorisation: the GUI takes your currently windows logged-in user to identify you, and uses the value in the nac_rights field for this user to control what you can do (client-side enforcement). we call this the 'NAC user'
The MySQL user is created in mysql and given rights to access certain tables remotely. This users is usually called 'inventwrite' (for historical reasons) and is granted access in mysql (as root) with commands like the following (see the MySQL section in the Master Server installation installation chapter).
Note that the password is set to 'PASSWORD1' below, adapt as necessary.
CREATE USER 'inventwrite'@'%' IDENTIFIED BY 'PASSWORD1';
grant SELECT,INSERT ON opennac.* to inventwrite@'%';
SET PASSWORD FOR inventwrite@'%' = OLD_PASSWORD('PASSWORD1');
grant SELECT,UPDATE ON opennac.oper to inventwrite@'%' ;
grant SELECT,UPDATE ON opennac.config to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.building to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.location to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.port to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.switch to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.vlan to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.systems to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.users to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.patchcable to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.vlanswitch to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.cabletype to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_class to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_class2 to inventwrite@'%' ;
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os1 to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os2 to inventwrite@'%';
grant SELECT,INSERT,UPDATE,DELETE ON opennac.sys_os3 to inventwrite@'%';
FLUSH PRIVILEGES ;
To verify that the inventwrite user exists:
select * from user where user="inventwrite"'
Next, inform the windows GUI about which username/password it should use. The username and password is stored in an encrypted string called 'auth' in the vmps.xml configuration file.
a) Starting the GUI vmps.exe b) Admin -> Encrypt User c) Fill in the Username and Password, and click on Generate d) Copy the value of the 'generated key' filed to the 'auth' field in vmps.xml e) quit the GUI
The GUI takes your currently windows logged-in user to identify you, to the server. It also sends the Windows domain to the server too.
So the windows username must also exist in the NAC user table, and the user must also have a permission value set. The permission is a value access to the nac_rights field and it can have three values (1=readonly, 2=write, 99=administrator).
Next, an SQL example to add a user called 'smith' to the users table, with administrator permissions:
insert into users (username, Surname, GivenName, nac_rights) values ('jsmith', 'John', 'Smith', 99);
Once users have been added, their permissions and other details change be changed in the GUI itself. (Administration -> Users).
Demo mode:
For demonstration puurposes, there is a 'demo mode' which is enabled if the field 'DemoMode' is set to '1' in the config table on the server.
If DemoMode is=1, and the DEMO company is set in vmps.xml, then all Windows users are given administrator access, which is fine for initial testing, but must be changed afterwards.
To disable, do the following as root on the MySQL prompt:
update config set value='0' WHERE name='DemoMode';
Verification of the windows domain
Start the GUI and press 'connect'.
See the Users Guide (http://freenac.net/en/community?q=en/usersguide) for a description of how to use the Windows interface.
Please refer to the FreeNAC Technical Guide (http://freenac.net/en/techguide).
Starting with a test switch on specific ports, NAC is enabled by configuring ports to use dynamic vlan assignment (“switchport access vlan dynamic” in IOS).
The switch performs a VLAN assignment requests for each new connection and will regularly re-confirm existing connections.
During this learning mode, all ports are open to all hosts. This is meant to avoid disrupting the network during the initialisation of the NAC service.
As noted above, new MAC addresses will be inserted into the database as unknown hosts. The NAC system will auto-discover the IP & DNS names of these systems (via the router_ipprogram called from cron).
The NAC administrator(s) or the super-users, will need to edit those hosts in the NAC and designate their VLAN and optionally document the end-device details and assign it to a user.
If at first you don't succeed, persevere :-) ... check the troubleshooting section of the FreeNAC User Guide notes, then search/ask questions in the Forums.
We are working hard on FreeNAC, so considering get the latest snapshot from subversion (SVN) once you're running.
See the users guide http://freenac.net/en/community?q=en/usersguide