<div dir="ltr">Alan,<div><br></div><div>Thank you for your reply and please find my inline response below.</div><div><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Sep 26, 2013 at 7:54 PM, Alan DeKok <span dir="ltr"><<a href="mailto:aland@deployingradius.com" target="_blank">aland@deployingradius.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="im">Don wrote:<br>
> That said, if EAP-GTC can be used along with ntlm_auth how do I<br>
> configure it to make that work?<br>
<br>
</div> Read the "gtc" sub-section of eap.conf. It tells you how to make<br>
EAP-GTC use a particular authentication method.<br></blockquote><div><br></div><div>I tried one of these inside "gtc" sub-section of eap.conf, that don't seem to work:</div><div> auth_type = ntlm_auth<br>
</div><div>or<br></div><div> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{User-Name} --password=%{User-Password}"</div><div><br></div><div>Though I haven't tried replacing User-Password with Cleartext-Password.</div>
<div>Do I have to place this under "gtc" sub-section inside inner-eap?</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="im"><br>
> I tried to execute ntlm_auth passing<br>
> --password=%{User-Password}, but that didn't work as User-Password is<br>
> empty.<br>
<br>
</div> You tried *where*? That matters.<br></blockquote><div><br></div><div>See my comment earlier. Did I place the configuration at the right sub-section?</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="im"><br>
> It says in eap.conf that GTC challenges the user with text and<br>
> the response from the user is taken to be the User-Password. Perhaps I<br>
> am executing ntlm_auth too early before GTC Password challenge is sent<br>
> out and received the response.<br>
><br>
> My questions are:<br>
> 1. How can I configure freeRadius so GTC will work with ntlm_auth?<br>
<br>
</div> a) configure ntlm_auth as per the <a href="http://deployingradius.com" target="_blank">deployingradius.com</a> docs, and the<br>
examples in the config files<br></blockquote><div><br></div><div>Yes, I saw the ntlm_auth configuration under modules/mschap and modules/ntlm_auth. As stated in my first email, I am able to configure freeRadius to authenticate against our Active Directory using EAP-MSCHAPv2 (ntlm_auth) and I am looking to see if using EAP-GTC will work as well.</div>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
b) tell EAP-GTC to use ntlm_auth as per the examples in the gtc<br>
configuration.</blockquote><div><br></div><div>As I mentioned earlier, I tried both auth_type = ntlm_auth nor ntlm_auth = "/usr/bin/ntlm_auth ..." command execution, but that don't work.</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div class="im">
> 2. Is it possible to send subsequent GTC challenge in addition to<br>
> default Password challenge? If possible, how do I configure the<br>
> subsequent GTC challenge?<br>
<br>
</div> No. EAP-GTC is only challenge-response. It doesn't do multiple<br>
challenges.</blockquote><div><br></div><div>The reason I am asking the question of multiple challenges because I am currently evaluating another vendor solution for multi-factor authentication thru EAP-PEAP/TLS with EAP-GTC and the solution prompts 2 additional inputs during authentication. Here is the link: <a href="https://www.duosecurity.com/docs/netmotion">https://www.duosecurity.com/docs/netmotion</a>. I thought if they can do it, freeRadius can do it as well.</div>
<div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class=""><font color="#888888">
Alan DeKok.<br>
-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</font></span></blockquote></div><br></div><div class="gmail_extra"><br></div><div class="gmail_extra">Regards,</div><div class="gmail_extra">Dono</div></div>