OPNsense Active Directory MemberOf: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
(→Login) |
|||
| Zeile 20: | Zeile 20: | ||
! Feld !! Wert | ! Feld !! Wert | ||
|- | |- | ||
| − | | Descriptive name || | + | | Descriptive name || win2022 |
|- | |- | ||
| Type || LDAP | | Type || LDAP | ||
|- | |- | ||
| − | | Hostname or IP address || | + | | Hostname or IP address || |
|- | |- | ||
| − | | Port value || | + | | Port value || 636 |
|- | |- | ||
| − | | Transport || | + | | Transport || TLS |
|- | |- | ||
| Protocol version || 3 | | Protocol version || 3 | ||
|- | |- | ||
| − | | Bind credentials || CN=ldapuser,OU=Service,DC= | + | | Bind credentials || CN=ldapuser,OU=Service,DC=lab,DC=int |
|- | |- | ||
| − | | Password || | + | | Password || 123Start$ |
|- | |- | ||
| Search scope || Entire Subtree | | Search scope || Entire Subtree | ||
| Zeile 40: | Zeile 40: | ||
| Base DN || DC=it13,DC=local | | Base DN || DC=it13,DC=local | ||
|- | |- | ||
| − | | Authentication containers || CN=Users,DC= | + | | Authentication containers || CN=Users,DC=lab,DC=int |
|- | |- | ||
| − | | Extended Query || memberOf=CN=opnsense,OU=Groups,DC= | + | | Extended Query || memberOf=CN=opnsense,OU=Groups,DC=lab,DC=int |
|- | |- | ||
| User naming attribute || sAMAccountName | | User naming attribute || sAMAccountName | ||
Version vom 22. August 2025, 15:21 Uhr
Adminuser in der AD mit automatischer Synchronistion
Ldapuser
- Er wird zum Binden an den DC gebraucht
CN=ldapuser,OU=Service,DC=lab,DC=int
Gruppe
- Gruppe wo die Admins drin sein sollen
CN=opnsense,OU=Groups,DC=lab,DC=int
User in der Admingruppe
CN=xinux,CN=Users,DC=lab,DC=int CN=hans,CN=Users,DC=lab,DC=int CN=lili,CN=Users,DC=lab,DC=int
Einbinden der AD
- Sytem
- Access
- Server
- Access
| Feld | Wert |
|---|---|
| Descriptive name | win2022 |
| Type | LDAP |
| Hostname or IP address | |
| Port value | 636 |
| Transport | TLS |
| Protocol version | 3 |
| Bind credentials | CN=ldapuser,OU=Service,DC=lab,DC=int |
| Password | 123Start$ |
| Search scope | Entire Subtree |
| Base DN | DC=it13,DC=local |
| Authentication containers | CN=Users,DC=lab,DC=int |
| Extended Query | memberOf=CN=opnsense,OU=Groups,DC=lab,DC=int |
| User naming attribute | sAMAccountName |
| Read properties | ☑ |
| Synchronize groups | ☑ |
| Constraint groups | ☐ |
| Limit groups | Nothing selected |
| Automatic user creation | ☑ |
| Match case insensitive | ☐ |
Quelle für die Authentification auswählen
- System
- Settings
- Administration
- Authentication
- Administration
- Settings
| Feld | Wert |
|---|---|
| Server | dc2019, Local Database |
| Disable integrated authentication | ☐ |
| Sudo | No password |
| Sudo group | wheel |
| User OTP seed | Nothing selected |
| Deployment type | Production |
Gruppe mit dem gleichen Namen anlegen
- System
- Access
- Groups
- Access
- opnsense
Danach Privilegien vergeben
- System
- Access
- Groups
- Assigned Privileges (Select All)
- Groups
- Access
| Feld | Wert |
|---|---|
| Defined By | user |
| gid | 2000 |
| Group name | opnsense |
| Description | |
| Privileges | All pages, Diagnostics: ARP Table, Diagnostics: Auth |
| Members | lili |
Wieder zu den Servers
- System
- Access
- Servers
- LDAP Server wählen
- Und Gruppe Mappen
- LDAP Server wählen
- Servers
- Access
| Feld | Wert |
|---|---|
| Read properties | ☑ |
| Synchronize groups | ☑ |
| Default groups | opnsense |
| Constraint groups | ☐ |
| Limit groups | Nothing selected |
| Automatic user creation | ☑ |
| Match case insensitive | ☐ |
User Synchronisieren
Login
| Feld | Wert |
|---|---|
| Language | Default |
| Login shell | /bin/csh |
Anmerkung
- Ich hatte das Problem das ich als Remote Admin keine Änderungen vornehmen kann.
- Es scheint ein Sicherheitsmechanismus zu sein.
- Diesen kann man deaktivieren in dem man folgende Zeile entfernt
- vi /conf/config.xml
<user-config-readonly/>
- Link