22 Jan
2019
22 Jan
'19
10:51 a.m.
Thanks for the replies, Alan and Eero. Much appreciated. I'm not in any hurry, but I'll spin up a new server and try working on it in the background. -Mark On Mon, Jan 21, 2019 at 3:34 PM Eero Volotinen <eero.volotinen@iki.fi> wrote: > Hi, > > check this document out > > https://github.com/rharmonson/richtech/wiki/CentOS-7-Minimal-&-Two-factor-Authentication-using-FreeRADIUS-3,-SSSD-1.12,-&-Google-Authenticator > > It might work. > > Eero > > > On Mon, Jan 21, 2019, 22:14 Mark J. Bobak <mark@bobak.net wrote: > > > Hi all, > > > > I've been on this list for a while, but I'm mostly just a lurker. > > > > But, I wanted to run a thought by folks here, before I spend too much > time > > on the effort. > > > > Currently, I'm running Freeradius 3.0.13 (which I think was current when > we > > installed) on RedHat Enterprise Linux 7 (7.6). > > > > I have a very simple implementation, using FreeRadius, Google > > Authenticator, and Linux. I create an account in Linux, and each Linux > > account has a Google Authenticator component, and I use FreeRadius as the > > backend to authenticate VPN users, coming from a Dell Sonicall TZ400. > > > > All this works with no issue. (The main reason I've been so quiet on > this > > list. ;-)) > > > > Users come in from VPN, supply username, password, and Google auth OTP, > and > > FreeRadius authenticates them. The users are defined in Linux, on the > > FreeRadius server itself. > > > > Since I first set this up a couple of years ago, we have made some > changes, > > including moving to a Samba backend to do Active Directory authentication > > for Windows logins. > > > > So, my question is, instead of maintaining a separate database for VPN, > is > > it possible (and how hard) to make my Samba server be the backend? So, > > when we add a user to the Samba AD server, they will gain VPN login > access, > > in addition to the Windows domain for Windows login access. > > > > If I go that way, would the Google Auth stuff have to move over to the > > Samba server? Would two-factor auth apply to Windows domain login as > well > > as VPN access? (That may be a Samba question, sorry.) Would the > > FreeRadius server need to move to the Samba server? > > > > Has anyone dome something like this? Was it difficult? > > > > I'm a little bit loathe to change a configuration that has been working > so > > well for so long....but as we grow, I'm willing to bet it will pay for > > itself in time saved. > > > > Any helpful hints? Pointers to docs? > > > > All comments are much appreciated. > > > > Thanks, > > > > -Mark > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html