Hi. Windows RADIUS server died.
I just got asked to try and get a freeradius server running ASAP. I got it installed on a freebsd 5.4 box that I had just finished getting squid running on, not implemented yet still testing. I see freeradius can use ntlm_auth as well, though I'm not clear on it's syntax. I have squid using the same authentication criteria as the radius server was using, that was based upon being in certain group. Can freeradius support this as well? My syntax in squid: ntlm_auth --helper-protocol=squid-2.5-ntlmssp --require-membership -of=S-1-5-21-1058564242-1277044956-825688854-1337 Domain Group (2) Can someone save me with a quick example or am I off to read and google?
Derrick MacPherson <dmacpherson@mainframe.ca> wrote:
I see freeradius can use ntlm_auth as well, though I'm not clear on it's syntax.
See radiusd.conf for an example, and the ntlm_auth docs for it's command-line arguments.
I have squid using the same authentication criteria as the radius server was using, that was based upon being in certain group. Can freeradius support this as well?
Sure, because FreeRADIUS doesn't care about command-line arguments to ntlm_auth. Add ass many arguments to ntlm_auth as you want.
ntlm_auth --helper-protocol=squid-2.5-ntlmssp
This *isn't* supported. You have to pass the username & password on the command line, as in the examples. And if you're doing MSCHAP, you MUST also pass the "request nt key" option, too.
--require-membership -of=S-1-5-21-1058564242-1277044956-825688854-1337 Domain Group (2)
This is just noise to FreeRADIUS, which doesn't look at it, and doesn't care. If ntlm_auth returns success, so does FreeRADIUS. If it returns fail, so does FreeRADIUS. Alan DeKok.
participants (2)
-
Alan DeKok -
Derrick MacPherson