<br><font size=2 face="Arial">All,</font>
<br><font size=2 face="Arial">I've been struggling to get AD authentication
working the way i want it. I wanted users to autom. login to the wireless
network with their windows(ad) account without needing to enter their passwords.</font>
<br><font size=2 face="Arial">I created this procedure with bits and pieces
i found on the internet, hints i got on this list and some things i found
out myself. </font>
<br><font size=2 face="Arial">I hope this saves some time to others(as
this was a popular question the list/google, but i didn't found the complete
solution that worked for me). If there are better options then the ones
i used let me know. I changed ipaddresses and realm names for privacy reasons,
but if there's something not clear anymore let me know.</font>
<br>
<br><font size=2 face="Arial"><u>1. General config needed for 802.1X</u></font>
<br><font size=2 face="Arial">I added the AP in the clients.conf file.</font>
<br><font size=2 face="Arial">I configured the AP to use WPA2/aes (also
had to add WPA/tkip).</font>
<br><font size=2 face="Arial">I entered the radiusserver i used below as
radius server(enabled 802.1X on the AP) and used the secret i configured
in the clients.conf file.</font>
<br>
<br>
<br><font size=2 face="Arial"><u>freeradius+AD windows 2003</u></font>
<br><font size=2 face="Arial">install samba(package samba+samba-common+samba-client)</font>
<br>
<br><font size=2 face="Arial"><b>configure /etc/samba/smb.conf:</b></font>
<br><font size=2 face="Arial">[root@radsv samba]# cat smb.conf</font>
<br><font size=2 face="Arial">realm = DIVISION.DOMAIN.NET</font>
<br><font size=2 face="Arial">workgroup = division.domain.net</font>
<br><font size=2 face="Arial">security = ADS</font>
<br><font size=2 face="Arial">encrypt passwords = yes</font>
<br><font size=2 face="Arial">password server = 192.168.100.3</font>
<br><font size=2 face="Arial"># idmap uid and idmap gid are aliases for</font>
<br><font size=2 face="Arial"># winbind uid and winbid gid, respectively</font>
<br><font size=2 face="Arial">idmap uid = 10000-20000</font>
<br><font size=2 face="Arial">idmap gid = 10000-20000</font>
<br><font size=2 face="Arial">winbind enum users = yes</font>
<br><font size=2 face="Arial">winbind enum groups = yes</font>
<br><font size=2 face="Arial">[test]</font>
<br><font size=2 face="Arial">comment = Samba functionality test directory</font>
<br><font size=2 face="Arial">path = /home/sambatest</font>
<br><font size=2 face="Arial">read only = no</font>
<br><font size=2 face="Arial">browsable = yes</font>
<br><font size=2 face="Arial">writable = yes</font>
<br><font size=2 face="Arial">guest ok = yes</font>
<br><font size=2 face="Arial">valid users = @DIVISION.DOMAIN.NET\"Domain
Users"</font>
<br><font size=2 face="Arial">[root@radsv samba]#</font>
<br>
<br>
<br><font size=2 face="Arial"><b>configure /etc/krb5.conf</b></font>
<br><font size=2 face="Arial">[root@radsv samba]# cat /etc/krb5.conf</font>
<br><font size=2 face="Arial">[logging]</font>
<br><font size=2 face="Arial">default = FILE:/var/log/krb5libs.log</font>
<br><font size=2 face="Arial">kdc = FILE:/var/log/krb5kdc.log</font>
<br><font size=2 face="Arial">admin_server = FILE:/var/log/kadmind.log</font>
<br>
<br><font size=2 face="Arial">[libdefaults]</font>
<br><font size=2 face="Arial">ticket_lifetime = 24000</font>
<br><font size=2 face="Arial">default_realm = DIVISION.DOMAIN.NET</font>
<br><font size=2 face="Arial">dns_lookup_realm = false</font>
<br><font size=2 face="Arial">dns_lookup_kdc = false</font>
<br><font size=2 face="Arial">default_etypes = des-cbc-crc des-cbc-md5</font>
<br><font size=2 face="Arial">default_etypes_des = des-cbc-crc des-cbc-md5</font>
<br><font size=2 face="Arial">default_tkt_enctypes = des-cbc-crc des-cbc-md5</font>
<br><font size=2 face="Arial">default_tgs_enctypes = des-cbc-crc</font>
<br>
<br><font size=2 face="Arial">[realms]</font>
<br><font size=2 face="Arial">DIVISION.DOMAIN.NET = {</font>
<br><font size=2 face="Arial">kdc = 192.168.100.3:88</font>
<br><font size=2 face="Arial">admin_server = 192.168.100.3:749</font>
<br><font size=2 face="Arial">default_domain = division.domain.net</font>
<br><font size=2 face="Arial">}</font>
<br>
<br><font size=2 face="Arial">[domain_realm]</font>
<br><font size=2 face="Arial">.division.domain.net = DIVISION.DOMAIN.NET</font>
<br><font size=2 face="Arial">division.domain.net = DIVISION.DOMAIN.NET</font>
<br>
<br><font size=2 face="Arial">[kdc]</font>
<br><font size=2 face="Arial">profile = /var/kerberos/krb5kdc/kdc.conf</font>
<br><font size=2 face="Arial">[appdefaults]</font>
<br><font size=2 face="Arial">pam = {</font>
<br><font size=2 face="Arial">debug = false</font>
<br><font size=2 face="Arial">ticket_lifetime = 36000</font>
<br><font size=2 face="Arial">renew_lifetime = 36000</font>
<br><font size=2 face="Arial">forwardable = true</font>
<br><font size=2 face="Arial">krb4_convert = false</font>
<br><font size=2 face="Arial">}</font>
<br><font size=2 face="Arial">[root@radsv samba]#</font>
<br>
<br><font size=2 face="Arial"><b>configure nsswitch.conf:</b></font>
<p><font size=3 face="Times New Roman">change following entries in nssswitch.conf:</font>
<p><font size=2 face="Courier New"> </font>
<p><font size=3 face="Times New Roman">passwd:files -> passwd:files
winbind</font>
<p><font size=3 face="Times New Roman">group:files -> group:files winbind</font>
<p>
<br><font size=2 face="Arial"><b>join the radius server to the domain (account
wireless-acount needs to be created and should have enough rights on AD)</b></font>
<br><font size=2 face="Arial">#net ads join -S 192.168.100.3 -U wireless-account</font>
<br>
<br>
<br><font size=2 face="Arial"><b>Configure freeradius:</b></font>
<br>
<br><font size=2 face="Arial"><b>Add user to /etc/raddb/users file(if you
use it for 802.1X you prob. also want to add vlan assignment entries):</b></font>
<br><font size=2 face="Arial">[root@radsv raddb]# cat users|grep -i user123</font>
<br><font size=2 face="Arial">user123 </font>
<br><font size=2 face="Arial">[root@radsv raddb]#</font>
<br>
<br><font size=2 face="Arial"><b>Add realm(s) to /etc/raddb/proxy.conf
file (add here all your aliases of your domain):</b></font>
<br><font size=2 face="Arial">realm DIVISION.DOMAIN.NET {</font>
<br><font size=2 face="Arial"> type
= radius</font>
<br><font size=2 face="Arial"> authhost
= LOCAL</font>
<br><font size=2 face="Arial"> accthost
= LOCAL</font>
<br><font size=2 face="Arial">}</font>
<br><font size=2 face="Arial">realm DIVISION {</font>
<br><font size=2 face="Arial"> type
= radius</font>
<br><font size=2 face="Arial"> authhost
= LOCAL</font>
<br><font size=2 face="Arial"> accthost
= LOCAL</font>
<br><font size=2 face="Arial">}</font>
<br>
<br><font size=2 face="Arial"><b>Configure /etc/raddb/radiusd.conf (change/activate
mschap part):</b></font>
<br><font size=2 face="Arial">mschap {</font>
<br><font size=2 face="Arial">
authtype = MS-CHAP</font>
<br><font size=2 face="Arial">
use_mppe = yes</font>
<br><font size=2 face="Arial">
require_strong = yes</font>
<br><font size=2 face="Arial">
with_ntdomain_hack = yes</font>
<br><font size=2 face="Arial">
require_encryption = yes</font>
<br><font size=2 face="Arial">
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}}
--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"</font>
<br><font size=2 face="Arial"> }</font>
<br>
<br>
<br><font size=2 face="Arial"><b>Configure eap.conf: </b></font>
<br>
<br><font size=2 face="Arial"><b>Uncomment tls keys(for production you
should create your own!!).</b></font>
<br><font size=2 face="Arial">tls {</font>
<br><font size=2 face="Arial">
private_key_password = whatever</font>
<br><font size=2 face="Arial">
private_key_file = ${raddbdir}/certs/cert-srv.pem</font>
<br><font size=2 face="Arial">
certificate_file = ${raddbdir}/certs/cert-srv.pem</font>
<br><font size=2 face="Arial">
CA_file = ${raddbdir}/certs/demoCA/cacert.pem</font>
<br><font size=2 face="Arial">
dh_file = ${raddbdir}/certs/dh</font>
<br><font size=2 face="Arial">
random_file = ${raddbdir}/certs/random</font>
<br><font size=2 face="Arial">
fragment_size = 1024</font>
<br><font size=2 face="Arial">
include_length = yes</font>
<br><font size=2 face="Arial">
}</font>
<br>
<br>
<br><font size=2 face="sans-serif">Stieven Struyf<br>
M.I.S. Division - System Operations <br>
Komatsu Europe International NV<br>
Mechelsesteenweg 586<br>
B-1800 Vilvoorde<br>
Stieven.Struyf@komatsu.eu<br>
Tel. +32 (0)2 2552551</font>