LDAP Insecure Shell Access

[skeels78]

I've successfully setup LDAP in pfSense - I can login to the GUI with the correct permissions. I'm also seeing the opposite - users that are not part of my defined group CANNOT login to the GUI.

This issue is with shell authentication using LDAP.
I have Shell Authentication Group DN configured with

CN=pfSense_Admin,OU=Groups,DC=ad,DC=example,DC=com

When I login (using SSH) to the shell with my AD user, I get the following output, followed by being dropped into the pfSense CLI menu.

You must be a memberOf of CN=pfSense_Admin,OU=Groups,DC=ad,DC=example,DC=com to login.

I do appear to have limited privileges - i.e. I can't restart services, run pfTop, or reboot the firewall.
I can open the shell and issue commands and a non-root user.

This isn't an issue is any given user doesn't have the correct attributes configured on their user account. But, that also isn't a solution to denying shell access to a firewall.

Has anyone seen this behavior or been able to replicate this? (I did see a Reddit post about this)

NOTE: I'm using Active Directory on Windows Server 2022.
NOTE: I've setup the necessary user attributes in AD to allow a user to login to the pfSense shell. I can already login to the shell - albeit in an insecure/broken way.

[stephenw10]

So, to be clear, you expect those users to be able to login at the CLI without a warning and have full permissions from the group?

[skeels78]

Yes (or whatever permissions are assigned to the group in the GUI). The issue here being that pfSense isn't respecting the group declaration. I can create a new AD user, not put that user in any groups, and still login to the CLI of pfSense.

[stephenw10]

So if you test it in Diag > Auth it returns the expected groups and they match the groups defined in pfSense?

[skeels78]

Yep! I can login to the GUI just fine assuming my user is part of the "pfSense_Admin" group - the same group I have setup in the shell auth group section