July 2005 - Freeradius-Users - lists.freeradius.org

External authentication and Reply-Message
by Velikanov 15 Jul '05

15 Jul '05

GOOD DAY. I use freeradius-snapshot-20050624. I want to use External authentication My radiusd.conf: ........................ exec echo { wait = yes program = "/usr/local/etc/raddb/radius.auth" input_pairs = request output_pairs = reply } ......................... authorize { ............. files echo sql } ......................... My users file: DEFAULT Auth-Type := Accept Reply-Message = "`%{echo:/usr/local/etc/raddb/radius.auth}` My test programm with name /usr/local/etc/raddb/radius.auth: #!/bin/sh echo "Reply-Message += You are already logged in" exit 0 # end of programm The aim is to authenticate users under sertain conditions, return "0" for Accept, "1" for Reject end return certain value of Reply-Message. When programm return "0" - I DO see the value "You are already logged in", BUT when programm return "1" - I DO NOT see the value "You are already logged in". I see Reply-Message = "``" It is the OUTPUT of radiusd -X for exit 0 rad_recv: Access-Request packet from host 192.168.98.100 port 1030, id=48, lengt h=58 User-Name = "morgan" User-Password = "test" NAS-IP-Address = 213.NNN.12.17 Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: No '@' in User-Name = "morgan", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 1 radius_xlat: Running registered xlat function of module echo for string '/usr/lo cal/etc/raddb/radius.auth' rlm_exec (echo): Executing /usr/local/etc/raddb/radius.auth Exec-Program output: Reply-Message += You are already logged in Exec-Program-Wait: plaintext: Reply-Message += You are already logged in Exec-Program: returned: 0 rlm_exec (echo): result 0 radius_xlat: '`Reply-Message += You are already logged in `' modcall[authorize]: module "files" returns ok for request 0 Exec-Program output: Reply-Message += You are already logged in Exec-Program-Wait: plaintext: Reply-Message += You are already logged in Exec-Program: returned: 0 modcall[authorize]: module "echo" returns ok for request 0 radius_xlat: 'morgan' rlm_sql (sql): sql_set_user escaped user --> 'morgan' rlm_sql (sql): Reserving sql socket id: 13 radius_xlat: 'SELECT * FROM TABLE(CAST(INTERNET_SECURITY.CHECK_USER ?('morgan', ?'213.130.12.17','','') AS RAD_ROWS)) ' rlm_sql (sql): User found in radcheck table radius_xlat: 'SELECT * FROM ?TABLE(CAST(INTERNET_SECURITY.REPLY_USER('morgan',' 213.130.12.17','PPP','Framed-User','', ?'','') AS RAD_ROWS)) ' rlm_sql (sql): Released sql socket id: 13 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 rlm_pap: login attempt with password test rlm_pap: Using clear text password. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: leaving group PAP (returns ok) for request 0 Processing the session section of radiusd.conf modcall: entering group session for request 0 ....................................................................... modcall[post-auth]: module "sql" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 48 to 192.168.98.100 port 1030 Reply-Message = "`Reply-Message += You are already logged in\n`" Framed-Compression = Van-Jacobson-TCP-IP ......................................................................... I DO SEE the VALUE of ATTRIBUTE "Reply-Message" It is the OUTPUT of radiusd -X for exit 1 rad_recv: Access-Request packet from host 192.168.98.100 port 1030, id=58, lengt h=58 User-Name = "morgan" User-Password = "test" NAS-IP-Address = 213.NNN.12.17 Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 rlm_realm: No '@' in User-Name = "morgan", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 users: Matched entry DEFAULT at line 1 radius_xlat: Running registered xlat function of module echo for string '/usr/lo cal/etc/raddb/radius.auth' rlm_exec (echo): Executing /usr/local/etc/raddb/radius.auth Exec-Program output: Reply-Message += You are already logged in Exec-Program-Wait: plaintext: Reply-Message += You are already logged in Exec-Program: returned: 1 rlm_exec (echo): result 1 radius_xlat: '``' modcall[authorize]: module "files" returns ok for request 2 Exec-Program output: Reply-Message += You are already logged in Exec-Program-Wait: plaintext: Reply-Message += You are already logged in Exec-Program: returned: 1 modcall[authorize]: module "echo" returns reject for request 2 modcall: leaving group authorize (returns reject) for request 2 Invalid user: [morgan/test] (from client apus_old port 0) Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 58 to 192.168.98.100 port 1030 Reply-Message = "``" Waking up in 4 seconds... I DO NOT SEE the VALUE of ATTRIBUTE "Reply-Message" WHERE IS MY MISTAKE(S). THANKS.

1 0

AW: Allowing any NAS to connect to my radiusd.
by Marc.Werner＠t-systems.com 15 Jul '05

15 Jul '05

>From the security point of it would be easier to launch some type of non-repudiation attacks without the need of spoofing I think. The shared secret can easily be recovered by sniffing some RADIUS traffic and decrypting it. I think this is even mentioned in the RFC. So removing one lock and only leaving an unsecure lock isn't a good idea I think... Rgds Marc -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Im Auftrag von Marcin Jessa Gesendet: Freitag, 15. Juli 2005 13:10 An: FreeRadius users mailing list Cc: Guy.Davies(a)telindus.co.uk Betreff: Re: Allowing any NAS to connect to my radiusd. On Fri, 15 Jul 2005 11:42:57 +0100 "Guy Davies" <Guy.Davies(a)telindus.co.uk> wrote: > Hi Marcin, > > You can create a subnet in clients.conf (e.g. 10.10.10.0/24) that can > use the same key. I think that doing 0.0.0.0/0 would be a very bad plan > since it only requires that an attacker know the shared key to be able > to send valid requests. Since all your devices are matched by a single > entry then *all* your devices by definition must use the same key Good point, they'd need the same key. >and it > becomes more likely that the knowledge of that key will "get out" and > you'll have the tedious task (if you even notice) of changing the secret > key on every single NAS. > > If you can constrain it to a small subnet, then that's slightly better > (although still somewhat risky). > > The best method is to have individual clients listed with *unique* keys > per client (yes, I know this is a real pain but if you want security > this is about the best you can do with the limited security afforded by > the shared key). I know how things work, I was just wondering about the approach since that would make some things easier for me. What other risks does one run when others to query your radiusd ? I dont think dictionary checks are that useful since passwords and username are all pretty long and use special characters. Could this have a more serious impact on the server like DOS or such ? > Rgds, > > Guy > > > -----Original Message----- > > From: freeradius-users-bounces(a)lists.freeradius.org > > [mailto:freeradius-users-bounces@lists.freeradius.org] On > > Behalf Of Marcin Jessa > > Sent: 15 July 2005 11:29 > > To: FreeRadius > > Subject: Allowing any NAS to connect to my radiusd. > > > > > > Hi. > > > > I would like to allow any NAS IP to connect to my radius > > server restricting connections from NAS only with shared > > secret - username and password. Is it possible to use 0.0.0.0 > > or ANY in clients.conf/SQL nas table ? What are the security > > issues having an open setup like that ? > > > > Cheers > > Marcin Jessa. > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us. > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Allowing any NAS to connect to my radiusd.
by Guy Davies 15 Jul '05

15 Jul '05

> > The best method is to have individual clients listed with *unique* > > keys per client (yes, I know this is a real pain but if you want > > security this is about the best you can do with the limited > security > > afforded by the shared key). > > I know how things work, I was just wondering about the > approach since that would make some things easier for me. > What other risks does one run when others to query your > radiusd ? I dont think dictionary checks are that useful > since passwords and username are all pretty long and use > special characters. Could this have a more serious impact on > the server like DOS or such ? Yes, I believe it would make DoS easier. Since a server can reject *any* request that comes from an "unknown" client, so long as the server can run the authentication check (calculate an MD5 hash) quickly enough, then a DoS will be less effective. If the calculation of an MD5 hash reveals an "authenticated" client, then the server must allocate resource to actually carry out the requested action. If sufficient requests are targetted at your server, it will have no resource to handle valid requests. The secret key per client is far from ideal (see some of the discussions about the benefits of DIAMETER over the last few days) but opening up your server like this is very unwise. I'd also say that while you may have excellent username and password selection criteria, opening up your system like this would simply remove one extra hurdle an attacker would have to scale to start obtaining information on your network. Rgds, Guy This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

RE: Allowing any NAS to connect to my radiusd.
by Guy Davies 15 Jul '05

15 Jul '05

Hi Marcin, You can create a subnet in clients.conf (e.g. 10.10.10.0/24) that can use the same key. I think that doing 0.0.0.0/0 would be a very bad plan since it only requires that an attacker know the shared key to be able to send valid requests. Since all your devices are matched by a single entry then *all* your devices by definition must use the same key and it becomes more likely that the knowledge of that key will "get out" and you'll have the tedious task (if you even notice) of changing the secret key on every single NAS. If you can constrain it to a small subnet, then that's slightly better (although still somewhat risky). The best method is to have individual clients listed with *unique* keys per client (yes, I know this is a real pain but if you want security this is about the best you can do with the limited security afforded by the shared key). Rgds, Guy > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Marcin Jessa > Sent: 15 July 2005 11:29 > To: FreeRadius > Subject: Allowing any NAS to connect to my radiusd. > > > Hi. > > I would like to allow any NAS IP to connect to my radius > server restricting connections from NAS only with shared > secret - username and password. Is it possible to use 0.0.0.0 > or ANY in clients.conf/SQL nas table ? What are the security > issues having an open setup like that ? > > Cheers > Marcin Jessa. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

2 1

Silly question - secure Radius?
by Shawn Kennedy 14 Jul '05

14 Jul '05

I am just getting started with setting up Radius, and with the reading I've done (mostly with the O'Reilly book), it seems that Radius in itself is insecure. Sure, you can use a Shared Secret and the password is sent with a MD5 hash, but is there anything better? Sorry for the dumb question, Shawn

6 18

mysql Accounting not working
by Leonardo Valente 14 Jul '05

14 Jul '05

Hello, I use Debian Linux Sarge, kernel 2.6.8-2(368), freeradius 1.0.2, and I'm trying to configure freeradius + mysql Accounting. I created database from script "db_mysql.sql", and created a user to access database with full privileges. I tested to access database from another host and it's fine. I can get authentication from localhost and another host. BUT freeradius is not insert accounting information in database. I used "freeradius -X" to get some debug information and I can't see it doing INSERT. But I know that freeradius connect into database when I start the daemon, I could see that in "mysql.log". I looked into "mysql.log" and freeradius is not doing INSERT. Database name, database username, password and host are set in "sql.conf". And "accounting" tag from "radiusd.conf" is: ------- accounting { sql } -------- Someone can tell me if I forgot some configuration? I just wanna do Mysql Accounting... Thanks in advance - "Dize-me tuas comunidades e te direi quem és..." Leonardo Valente MSN: agunoiado(a)hotmail.com __________________________________________________ Converse com seus amigos em tempo real com o Yahoo! Messenger http://br.download.yahoo.com/messenger/

2 2

Re: FreeRadius and PIX 520 accounting
by lmarante＠aerolineas.com.ar 14 Jul '05

14 Jul '05

2 1

ntlm_auth w/ plain test passwords to Windows 2003 domain
by Ken George 14 Jul '05

14 Jul '05

Still unable to get this to work via freeradius, but works with ntlm_auth from the command line. [root@phllnxsrv01 raddb]# ntlm_auth --username="test ops" --password=m1sg0ps --domain=usmisgnet --request-NT-key NT_STATUS_OK: Success (0x0) BUT wbinfo -a "ken george"%262144 plaintext password authentication failed error code was NT_STATUS_NO_SUCH_USER (0xc0000064) error messsage was: No such user Could not authenticate user ken george%262144 with plaintext password challenge/response password authentication succeeded Is this a samba/winbindd/Windows 2003 issue or is my freeradius configuration still lacking?? radiusd.conf exec win_domain { wait = yes input_pairs = request output_pairs = reply program = "/usr/bin/ntlm_auth --username=\"%{User-Name}\" --password=\"%{User-Password}\" --domain=usmisgnet" } . . . # Auth-Type win_domain { win_domain } # In the users file # DEFAULT Auth-Type = win_domain # radtest "test ops" m1sg0ps localhost 0 xxxxxx [root@phllnxsrv01 raddb]# radiusd -xxyz -l stdout Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "before" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) exec: wait = yes exec: program = "/usr/bin/ntlm_auth --username="%{User-Name}" --password="%{User-Password}" --domain=usmisgnet" exec: input_pairs = "request" exec: output_pairs = "reply" exec: packet_type = "(null)" Module: Instantiated exec (win_domain) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = yes preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = yes Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (ntdomain) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Initializing the thread pool... thread: start_servers = 5 thread: max_servers = 32 thread: min_spare_servers = 3 thread: max_spare_servers = 10 thread: max_requests_per_server = 0 thread: cleanup_delay = 5 Thread 1 waiting to be assigned a request Thread spawned new child 1. Total threads in pool: 1 Thread 2 waiting to be assigned a request Thread spawned new child 2. Total threads in pool: 2 Thread 3 waiting to be assigned a request Thread spawned new child 3. Total threads in pool: 3 Thread 4 waiting to be assigned a request Thread spawned new child 4. Total threads in pool: 4 Thread 5 waiting to be assigned a request Thread spawned new child 5. Total threads in pool: 5 Thread pool initialized Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32785, id=139, length=60 --- Walking the entire request list --- Waking up in 31 seconds... Threads: total/active/spare threads = 5/0/5 Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) User-Name = "test ops" User-Password = "xxxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_lowerpair: User-Name now 'test ops' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test ops", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "test ops", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 204 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type win_domain auth: type "win_domain" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 radius_xlat: '/usr/bin/ntlm_auth --username="test ops" --password="xxxxxx" --domain=usmisgnet' Exec-Program: /usr/bin/ntlm_auth --username="test ops" --password="xxxxxx" --domain=usmisgnet Exec-Program output: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Exec-Program-Wait: plaintext: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Exec-Program: returned: 1 rlm_exec (win_domain): External script failed modcall[authenticate]: module "win_domain" returns fail for request 0 modcall: group Auth-Type returns fail for request 0 auth: Failed to validate the user. Login incorrect: [test ops] (from client localhost port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 127.0.0.1:32785, id=139, length=60 Sending Access-Reject of id 139 to 127.0.0.1:32785 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 139 with timestamp 42d682b2 Nothing to do. Sleeping until we see a request. Ken George Systems and Network Engineering Mi Services Group, Inc. +1 610-230-2500 x129

2 1

Server Suggestion
by King, Michael 14 Jul '05

14 Jul '05

We're going to be setting up a freeRADIUS server to service around 400 simultaneous connections. (500 AP's, 4000 users, about 400 online at once) Accounting info would be on another different server.(Not part of FreeRADIUS) What's a good server for this? What's more important? Memory or CPU? I was thinking a dell poweredge 750, 2.8Ghz, 1Gig of RAM, 73G drive. Thoughts?

3 2

RE: Active Directory and FreeRadius
by Talwar, Puneet (NIH/NIAID) 14 Jul '05

14 Jul '05

Well I can use pam_krb5, but what I am trying to accomplish here is that I have quite a few Linux workstation on my network and I thought if I can setup those Linux workstation to point to the radius server where they login using there Active Directory credentials. So I am not sure if this can be done or not? But would like hear if anybody who has done something similar to what I am doing. Thanks, -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Wednesday, July 13, 2005 2:58 PM To: FreeRadius users mailing list Subject: Re: Active Directory and FreeRadius "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > I was able to auth against AD by setting up KRB5 on RHEL. Now I would like > to setup freeradius where I will have bunch of UNIX workstation that will > point to the freeradius server using pam_radius_auth module and will auth > against radius server using their AD credentials. Why not just use pam_krb5? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2