<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2900.2722" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>Hi all,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>i need some more ideas for doing a good, stable and
easy to use connection between freeradius and Active Directory.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>first of all a little bit of our configuration and
history:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>i've set up a freeradius server for
authentication/authorization/accounting of dsl-dial-in user on a cisco
asa.</FONT></DIV>
<DIV><FONT face=Arial size=2>it works very well:</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>- local (Auth-type = system) authentication on a
linux box</FONT></DIV>
<DIV><FONT face=Arial size=2>- authorisation (especially cisco
acl's)</FONT></DIV>
<DIV><FONT face=Arial size=2>- mysql-db -- accounting (this is my favourite
feature!!!!!)</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>a new requirement was given to make a connection
between the asa and our central authentication: Active Directory. AD is a
must in our company. </FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>first there were many thoughts in my brain, then i
decided to use a NIS-Master-Client combination to do this stuff (it was the
easiest way for me to implement).</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>-> freeradius-server is the NIS-client, so
Auth-Type = system still remains</FONT></DIV>
<DIV><FONT face=Arial size=2>-> the AD-Servers have installed MS SFU
(Services for Unix) with a NIS-Master Server.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Everything works well ... but the procedure to get
the AD-Users into the SFU-NIS-Master-Server seems to be a little bit tricky,
particularly the password stuff (it must be changed in the AD at the first
time it was brought into SFU although it was synchronized !!??) </FONT></DIV>
<DIV><FONT face=Arial size=2>I think, this is a solution for 1-100 Users, but
not for 2000 and this is our aim.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>a LDAP-Server is not planned in our
company.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>So now my questions:</FONT></DIV>
<DIV><FONT face=Arial size=2>----------------------------</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>- has anybody implemented a similar
system?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>- what could be a alternative/better way to make a
connection between freeradius and the AD-Servers only for
password-authentication? Authorization and Accounting still remains on the
linux-box</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>- I've heard from our AD-God's ;-) that kerberos is
used in the AD-system and that it could be a way?</FONT></DIV>
<DIV><FONT face=Arial size=2>---> has anybody tried this?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>I would be glad for any idea</FONT> <FONT
face=Arial size=2>or hints.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Thank you.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV></BODY></HTML>