|
Notes |
|
|
(0002101)
|
|
dloper
|
|
2015-11-12 09:07
|
|
|
|
|
(0003101)
|
|
dloper
|
|
2016-04-19 17:43
|
|
The file /etc/raddb/mods-available/ldap uses an older convention for its format. Should be more like this:
ldap {
server = "localhost"
identity = "cn=manager,ou=Internal,dc=system,dc=lan"
password = odt6Xj4EvVrY3ocj
base_dn = "dc=system,dc=lan"
update {
control:Password-With-Header += 'userPassword'
}
user {
base_dn = "${..base_dn}"
filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
}
group {
base_dn = "${..base_dn}"
filter = "(objectClass=posixGroup)"
membership_attribute = "memberOf"
}
profile {
}
client {
base_dn = "${..base_dn}"
filter = '(objectClass=frClient)'
attribute {
identifier = 'radiusClientIdentifier'
secret = 'radiusClientSecret'
}
}
accounting {
reference = "%{tolower:type.%{Acct-Status-Type}}"
type {
start {
update {
description := "Online at %S"
}
}
interim-update {
update {
description := "Last seen at %S"
}
}
stop {
update {
description := "Offline at %S"
}
}
}
}
post-auth {
update {
description := "Authenticated at %S"
}
}
options {
chase_referrals = yes
rebind = yes
timeout = 10
timelimit = 3
net_timeout = 1
idle = 60
probes = 3
interval = 3
ldap_debug = 0x0028
}
tls {
start_tls = no
}
pool {
start = 5
min = 4
max = ${thread[pool].max_servers}
spare = 3
uses = 0
lifetime = 0
idle_timeout = 60
}
} |
|
|
|
(0003111)
|
|
dloper
|
|
2016-04-20 13:09
|
|
For the EAP tunnel, it would be best to run it through MSCHAP rather than the older process of looking up the hashes directly in LDAP and then comparing the hashes. To make this change we merely do the following:
usermod -a -G wbpriv radiusd
This allow radius to submit ntlm_auth requests to the winbind socket at /var/lib/samba/winbindd_privileged/pipe
Then you need to turn on the ntlm_auth with the following patch:
--- /etc/raddb/mods-available/mschap.orig 2016-04-19 19:24:49.194497463 -0400
+++ /etc/raddb/mods-available/mschap 2016-04-20 15:03:55.731673388 -0400
@@ -56,6 +56,7 @@
# the "best" user name for the request.
#
# ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}"
+ ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}"
# The default is to wait 10 seconds for ntlm_auth to
# complete. This is a long time, and if it's taking that
Making these changes, and the change prior, allows for EAP authentication from windows workstations to a wireless access point running WPA-Infrastructure mode against RADIUS. |
|
|
|
(0003121)
|
|
dloper
|
|
2016-04-22 08:44
|
|
base_dn in /etc/raddb/mods-available/ldap is improperly rendered as 'basedn'
ntlm_auth parameter in /etc/raddb/mods-available/mschap is not set. Should be:
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}"
Instead of:
# ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" |
|