Laker Netman <laker_netman@yahoo.com> wrote:
Not sure I understand. To my knowledge, currently our AD doesn't contain any info that would differentiate a "wireless" user from one who is "wired". Based on the authenticating NAS (which is identifiable as wired vs wireless at least to RADIUS) how could I tie that to an AD group?
You're completely down the wrong path. AD is a database. It's a directory. Using anonymous bind, there is very little data you can get from it. Stop talking about solutions, as you don't know how the technology works. Instead, talk about your goals, independent of the underlying technology.
So, when I see cleartext passwords (provided to RADIUS via NAS auth dialogs) in a "radiusd -X" output to the terminal it's due to the fact that they have already been decoded via the symmetric NAS-RADIUS key?
Yes. But you don't see that for wireless.
Is there any method to send/receive the password between FR and AD encrypted?
SSL.
A URL or path to the RADIUS doc supporting this would be appreciated.
raddb/radiusd.conf. See the "tls" comments in the ldap configuration.
My statement was intentionally flippant, though not meant to be disrepectfully so. It is the culmination of much frustration at finding lots of tangible data to make a functional system, yet, all of the pages tend to end with the cliche (paraphrasing now) "and some other settings we all know it needs..." We who?
Please point to FreeRADIUS documentation that says that. I've never seen it. If you're talking about non-freeradius web sites, go complain to them.
I'm not stupid, but I'm not perfect. THAT'S why I'm seeking help (not judgement) from the list.
Let me be perfectly clear: No one will be able to help you if you cannot describe what you want in a manner they understand. So far, you've made it clear you're confused about the terminology, and you haven't articulated what you want to do.
If there are useful docs I haven't found, tell me. If I don't fully understand what I'm reading and ask for help, either help me or don't.
Part of helping you is asking you for information you haven't supplied. That information is needed to help you. If your response is to get upset, then everyone can only conclude you don't want to solve your problem.
I have read the majority of your posts since 2002 Mr. DeKok. Clearly, you are quite knowledgable regarding RADIUS. However, your disdain for the mortals who wish to use a tool, rather than wonder at its mystical intricacies is evident on repeated occasions in your responses. So not everyone is as clever as you... insult or help, which produces a better outcome?
For people who get angry when I ask for more information, insults. For people who answer the questions I ask, help. And then they solve their problem. You choose which group you fall into. I don't have time to care what you think about me. Alan DeKok.