User:Mhavela/squark-auth-snmp - Revision history

Zcrayfish: Nowiki'd a dead link.

2023-08-28T02:43:01Z

Nowiki'd a dead link.

← Older revision		Revision as of 02:43, 28 August 2023
Line 90:		Line 90:
	</pre>		</pre>

	{{Tip\|For more information on the 'squark_auth' options available, run the command 'man squark-auth-snmp' in your terminal or browse the [http://git.alpinelinux.org/cgit/squark/tree/ squark git tree].}}		{{Tip\|For more information on the 'squark_auth' options available, run the command 'man squark-auth-snmp' in your terminal or browse the <nowiki>[http://git.alpinelinux.org/cgit/squark/tree/ squark git tree].</nowiki>}}

	== Configure net-snmp ==		== Configure net-snmp ==

Zcrayfish: nowiki'd a dead link.

2023-08-28T02:42:03Z

nowiki'd a dead link.

← Older revision		Revision as of 02:42, 28 August 2023
Line 51:		Line 51:
	A browser needs to be opened, and the user is given a user-name and password prompt.		A browser needs to be opened, and the user is given a user-name and password prompt.

	For more information on configuring web-based authentication on an HP switch, see [http://h40060.www4.hp.com/procurve/uk/en/pdfs/application-notes/AN-S1_Web-Authentication-final-080608.pdf ~~this link]~~.		For more information on configuring web-based authentication on an HP switch, see <nowiki>http://h40060.www4.hp.com/procurve/uk/en/pdfs/application-notes/AN-S1_Web-Authentication-final-080608.pdf</nowiki>.
	{{Todo\|Is web-based authentication really related to squark-auth-snmp, or is it just a "feature" that could give even more information to squark-auth-snmp?}}		{{Todo\|Is web-based authentication really related to squark-auth-snmp, or is it just a "feature" that could give even more information to squark-auth-snmp?}}

Mhavela: Confirmed which switches works. Also had a issue when a switch did not apply the 'dst-ip-of-request' until the switch was rebooted

2011-12-23T09:25:59Z

Confirmed which switches works. Also had a issue when a switch did not apply the 'dst-ip-of-request' until the switch was rebooted

← Older revision		Revision as of 09:25, 23 December 2011
Line 10:		Line 10:
	* HP Procurve 5400zl		* HP Procurve 5400zl
	* HP Procurve 1810G 24GE		* HP Procurve 1810G 24GE
	~~{{Todo\|Confirm if "~~HP Procurve 2150-48~~" works<BR>~~		* HP Procurve 2150-48
	~~Confirm if "~~HP Procurve 2650~~" works}}~~		* HP Procurve 2650

	{{Note\|The below examples will create/use a community called 'public'. You can replace each occurance of 'public' with something that suits your needs.<BR>In some examples a IP-address might be mentioned. Change those to reflect your configuration.<BR>		{{Note\|The below examples will create/use a community called 'public'. You can replace each occurance of 'public' with something that suits your needs.<BR>In some examples a IP-address might be mentioned. Change those to reflect your configuration.<BR>
Line 40:		Line 40:

	Run the above commands ''(exactly as they appear above)'' on all switches that the squark-auth-snmp plugin will run snmp queries against.		Run the above commands ''(exactly as they appear above)'' on all switches that the squark-auth-snmp plugin will run snmp queries against.
			{{warning\|Your switch might need to be rebooted in order to apply the 'dst-ip-of-request' setting.}}

	=== Link Layer Discovery Protocol ===		=== Link Layer Discovery Protocol ===
	If you have multiple switches in your environment, Link Layer Discovery Protocol (LLDP) should be enabled in order for 'squark-auth-snmp' to work properly.<BR>		If you have multiple switches in your environment, Link Layer Discovery Protocol (LLDP) should be enabled in order for 'squark-auth-snmp' to work properly.<BR>
	If the IP of the switch that you have specified is a core switch ''(such as in a star topology network)'', and all the switches in your network have LLDP enabled ''(usually enabled by default)'', then your network topology should be automatically discoverable.		If the IP of the switch that you have specified is a core switch ''(such as in a star topology network)'', and all the switches in your network have LLDP enabled ''(usually enabled by default)'', then your network topology should be automatically discoverable.

	~~{{Todo\|Document how to configure and debug lldp}}~~

	=== web-based authentication ===		=== web-based authentication ===

Mhavela: Debug output example

2011-12-23T05:52:58Z

Debug output example

← Older revision		Revision as of 05:52, 23 December 2011
Line 144:		Line 144:
	The command entered in the CLI could look like this:		The command entered in the CLI could look like this:
	{{cmd\|a 10.82.96.123}}		{{cmd\|a 10.82.96.123}}
	Either you get a "ERR" or "OK" result which will help you in your debugging.		Either you get a "a ERR" or "a OK user=<switchname>_<portname>_<mac address>" result which will help you in your debugging.

Mhavela: How to debug squark-auth-snmp

2011-12-23T05:39:43Z

How to debug squark-auth-snmp

← Older revision		Revision as of 05:39, 23 December 2011
Line 131:		Line 131:
	{{cmd\|rc-update add squid default		{{cmd\|rc-update add squid default
	rc-update add snmpd default}}		rc-update add snmpd default}}

			== Debugging ==
			=== Squark ===
			If you are having trouble getting 'squark-auth-snmp' to give you the data you are wanting to see, you could run 'squark-auth-snmp' standalone in a terminal to debug your syntax.

			Run the 'squark-auth-snmp' command with the options you are planning to use ''(below is just a example on how that might look)'':
			{{cmd\|/usr/bin/squark-auth-snmp -f "%N-%i-%M" -c public -r 10.82.72.221 -i eth1.96 -v 96}}
			You will end up in the squark-proxy-cli mode.<BR>
			Feed the CLI with 2 values separated with a whitespace.
			# A index ''(this could basically be anything without a whitespace)''
			# A IP-address of a host connected to your switch(es)
			The command entered in the CLI could look like this:
			{{cmd\|a 10.82.96.123}}
			Either you get a "ERR" or "OK" result which will help you in your debugging.

Mhavela: User:Mhavela/sandbox2 moved to User:Mhavela/squark-auth-snmp: I felt for it :-)

2011-12-23T02:33:03Z

User:Mhavela/sandbox2 moved to User:Mhavela/squark-auth-snmp: I felt for it :-)

← Older revision	Revision as of 02:33, 23 December 2011
(No difference)

Mhavela: Re-inserted notes about web-based authentication (still not sure if they belong here)

2011-12-23T02:27:27Z

Re-inserted notes about web-based authentication (still not sure if they belong here)

← Older revision		Revision as of 02:27, 23 December 2011
Line 46:		Line 46:

	{{Todo\|Document how to configure and debug lldp}}		{{Todo\|Document how to configure and debug lldp}}

			=== web-based authentication ===
			It is possible to configure HP Procurve switches to do port-based web authentication.<BR>
			A network device initiates traffic on a port, and is assigned to a "guest" vlan with limited or no network access.<BR>
			A browser needs to be opened, and the user is given a user-name and password prompt.

			For more information on configuring web-based authentication on an HP switch, see [http://h40060.www4.hp.com/procurve/uk/en/pdfs/application-notes/AN-S1_Web-Authentication-final-080608.pdf this link].
			{{Todo\|Is web-based authentication really related to squark-auth-snmp, or is it just a "feature" that could give even more information to squark-auth-snmp?}}

	== Configure squid & squark ==		== Configure squid & squark ==

Mhavela: Various modifications

2011-12-22T09:23:16Z

Various modifications

Show changes

Mhavela at 07:50, 22 December 2011

2011-12-22T07:50:12Z

← Older revision		Revision as of 07:50, 22 December 2011
Line 5:		Line 5:
	'squark-auth-snmp' queries the switch via SNMP using standard MIBs to obtain various information.<BR>		'squark-auth-snmp' queries the switch via SNMP using standard MIBs to obtain various information.<BR>
	The information is then injected into the squid access logs ''(which can help auditors when analysing the logs)''.<BR>		The information is then injected into the squid access logs ''(which can help auditors when analysing the logs)''.<BR>
	~~{{todo\|Mention lldp above?}}~~

	Switches that confirmed to function at least in some degree:<BR>		Switches that confirmed to function (at least in some degree):<BR>
	* HP Procurve 5400zl		* HP Procurve 5400zl
	* HP Procurve 1810G 24GE		* HP Procurve 1810G 24GE
Line 15:		Line 14:
	{{Note\|For more information see the 'squark-auth-snmp' documentation [http://git.alpinelinux.org/cgit/squark/tree/ here] ''(git tree)''}}		{{Note\|For more information see the 'squark-auth-snmp' documentation [http://git.alpinelinux.org/cgit/squark/tree/ here] ''(git tree)''}}

	==~~= Enable SNMP Lookups on HP Procurve Device =~~==		== Configuring the switch ==
			{{todo\|We need to mention/document "lldp" somewhere}}

	~~Create an~~ SNMP read-only community on your HP Procurve ~~Switch~~, or ~~use one~~ that ~~already exists (~~the following ~~example uses~~ "public" as ~~a community name - adjust as you like):~~		=== Enable SNMP Lookups ===
			We need a 'SNMP community' configured on the switch (which has at least 'read-only' or 'restricted' permissions).<BR>
			If your switch does not have such 'SNMP community', you will need to create one.
			{{Note\|Procedures on how to view/modify/create SNMP communities on a switch varies on depending on brand or model of the switch.<BR>You will need to read you manual to figure out how to apply the changes to your own switch.<BR>The upcoming examples assumes you are using a "HP Procurve" switch.}}

			Start by loggin on to your switch ''(use telnet, ssh or a serial cable. The manual that came with your switch will describe how this is done for your switch)''.

			==== View your snmp-server settings ====
			Run the following command to view your current snmp-settings
			{{cmd\|show snmp-server}}

			==== Create a SNMP community ====
			In this case we will create a SNMP community called "public" and giving it "restricted" rights.<BR>
			We will also configure the switch to send SNMP replies from the same IP address as the one on which the corresponding SNMP request was received.

	{{cmd\|configure		{{cmd\|configure
Line 24:		Line 37:
	exit }}		exit }}

	~~The 2nd last command ensures that the SNMP replies are always returned from the switch's primary management interface.~~ Run the above commands on all switches that the squark-auth plugin will run snmp queries against~~. Run them exactly as they appear~~.		Run the above commands ''(exactly as they appear above)'' on all switches that the squark-auth-snmp plugin will run snmp queries against.

	==~~= Install Squark and~~ Configure ~~Squid =~~==		== Configure squid & squark ==

			=== Install and configure squark ===
	{{cmd\|apk add squark}}		{{cmd\|apk add squark}}

	~~The squark-auth binary used by~~ squid ~~is copied into the /usr/local/bin directory. All further configuration is done in /etc/squid/squid.conf:~~		=== Install and configure squid ===

	{{~~Note~~\| The following configuration assumes that you are using SNMPv2c}}		{{Todo\|What does "The following configuration assumes that you are using SNMPv2c" mean?}}

	<pre>		<pre>
Line 54:		Line 68:
	{{Note\| If you have multiple switches in your environment, Link Layer Discovery Protocol (LLDP) should be enabled in order for squark-auth to work properly. If the IP of the switch that you have specified is a core switch (such as in a star topology network, and the all the switches in your network have LLDP enabled (usually enabled by default), then your network topology should be automatically discoverable.}}		{{Note\| If you have multiple switches in your environment, Link Layer Discovery Protocol (LLDP) should be enabled in order for squark-auth to work properly. If the IP of the switch that you have specified is a core switch (such as in a star topology network, and the all the switches in your network have LLDP enabled (usually enabled by default), then your network topology should be automatically discoverable.}}

	{{Note\| For more information on the squark_auth options available, run the command '''man squark-auth'''.}}		{{Note\| For more information on the squark_auth options available, run the command '''man squark-auth-snmp'''.}}

	=== Optional: SNMP v3 Configuration ===		=== Optional: SNMP v3 Configuration ===

Mhavela: Introduction

2011-12-22T05:54:09Z

Introduction

New page

{{draft}}
= Using squark-auth-snmp =
== Introduction ==
This document describes how to use 'squark-auth-snmp' as squid authentication helper to obtain a username or other useful information from a switch.<BR>
'squark-auth-snmp' queries the switch via SNMP using standard MIBs to obtain various information.<BR>
The information is then injected into the squid access logs ''(which can help auditors when analysing the logs)''.<BR>
{{todo|Mention lldp above?}}

Switches that confirmed to function at least in some degree:<BR>
* HP Procurve 5400zl
* HP Procurve 1810G 24GE
{{Todo|Confirm if "HP Procurve 2150-48" works}}
{{Todo|Confirm if "HP Procurve 2650" works}}

{{Note|For more information see the 'squark-auth-snmp' documentation [http://git.alpinelinux.org/cgit/squark/tree/ here] ''(git tree)''}}

=== Enable SNMP Lookups on HP Procurve Device ===

Create an SNMP read-only community on your HP Procurve Switch, or use one that already exists (the following example uses "public" as a community name - adjust as you like):

{{cmd|configure
snmp-server community "public" restricted
snmp-server response-source dst-ip-of-request
exit }}

The 2nd last command ensures that the SNMP replies are always returned from the switch's primary management interface. Run the above commands on all switches that the squark-auth plugin will run snmp queries against. Run them exactly as they appear.

=== Install Squark and Configure Squid ===

{{cmd|apk add squark}}

The squark-auth binary used by squid is copied into the /usr/local/bin directory. All further configuration is done in /etc/squid/squid.conf:

{{Note| The following configuration assumes that you are using SNMPv2c}}

<pre>
#external ACL squid auth helper
# Squark authentication external acl
external_acl_type squark_auth children=1 ttl=1800 negative_ttl=60 concurrency=128 grace=10 %SRC /usr/local/bin/squark-auth -c <communityname> -r <ip.of.switch> -i VLAN<id> -v <id>
acl Zone_D_SquarkAuth external squark_auth
</pre>

Replace <communityname> with the SNMPv2 community name you have configured on your switch. Replace <ip.of.switch> with the IP of your switch, and replace <id> with the VLAN Id number of the VLAN that the clients will be connected to.

Here is an example to illustrate how the above configuration could look:

<pre>
#external ACL squid auth helper
# Squark authentication external acl
external_acl_type squark_auth children=1 ttl=1800 negative_ttl=60 concurrency=128 grace=10 %SRC /usr/local/bin/squark-auth -c public -r 192.168.0.1 -i VLAN5 -v 5
acl Zone_D_SquarkAuth external squark_auth
</pre>

{{Note| If you have multiple switches in your environment, Link Layer Discovery Protocol (LLDP) should be enabled in order for squark-auth to work properly. If the IP of the switch that you have specified is a core switch (such as in a star topology network, and the all the switches in your network have LLDP enabled (usually enabled by default), then your network topology should be automatically discoverable.}}

{{Note| For more information on the squark_auth options available, run the command '''man squark-auth'''.}}

=== Optional: SNMP v3 Configuration ===

Squark will use the configuration specified in '''/etc/snmp/snmp.conf''' when snmpv3 is specified as the preferred version of SNMP to use.

Ensure that you have at least the following in '''/etc/snmp/snmp.conf''':

<pre>
defContext none
defSecurityName <username>
defAuthPassphrase <password>
defVersion 3
defAuthType MD5
defSecurityLevel authNoPriv
</pre>

Adjust the above as dictated by the SNMP v3 configuration on your switch.