PEAP Machine Auth without NTLM or LDAP
Hello, I want to do machine auth with PEAP for my laptop before windows logon. I managed to do it with "ntlm_auth" before, but this time, I've another problem, there is no PDC. So, is it possible to use the "users" file instead like this: "computer_name" User-Password == "" (As far as I remember it was impossible...) Any suggestions ? Regards, Jeremy Cluzel
=?ISO-8859-1?Q?J=E9r=E9my_Cluzel?= <j.cluzel@online.fr> wrote:
I want to do machine auth with PEAP for my laptop before windows logon. I managed to do it with "ntlm_auth" before, but this time, I've another problem, there is no PDC. So, is it possible to use the "users" file instead like this: "computer_name" User-Password == ""
It's impossible because you don't know what the password is. And AD won't tell you. And it changes randomly. Alan DeKok.
Jérémy Cluzel wrote:
Hello,
I want to do machine auth with PEAP for my laptop before windows logon. I managed to do it with "ntlm_auth" before, but this time, I've another problem, there is no PDC.
If there is no PDC, there's no domain, so there *is* no machine account. You could use a machine certificate and EAP-TLS, but limitations of the winxp built in supplicant mean you'd have to also use EAP-TLS for the users as well.
So, is it possible to use the "users" file instead like this: "computer_name" User-Password == ""
(As far as I remember it was impossible...)
It is, because there is only a machine account if there is a domain (in which case there is a PDC)
Any suggestions ?
Regards,
Jeremy Cluzel - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
HI, I am trying a similar setup with some variation.
If there is no PDC, there's no domain, so there *is* no machine account.
I have setup a Samba PDC and am using Novell eDirectory as the back-end store. In this scenario is it possible to perform PEAP-MSCHAPv2 machine authentication by adding the WinXP machine to the Samba PDC and without using ntlm_auth. Any help will be much appreciated. Regards, -Sayantan
"Sayantan Bhowmick" <sbhowmick@novell.com> wrote:
I have setup a Samba PDC and am using Novell eDirectory as the back-end store. In this scenario is it possible to perform PEAP-MSCHAPv2 machine authentication by adding the WinXP machine to the Samba PDC and without using ntlm_auth. Any help will be much appreciated.
Not that I'm aware of. Machine accounts are "magic" in the Win2K domains, and the XP client will expect to do all sorts of things that Samba doesn't implement, because Samba is an NT4 domain, not a Win2K domain. Alan DeKok.
Sayantan Bhowmick wrote:
HI, I am trying a similar setup with some variation.
If there is no PDC, there's no domain, so there *is* no machine account.
I have setup a Samba PDC and am using Novell eDirectory as the back-end store. In this scenario is it possible to perform PEAP-MSCHAPv2 machine authentication by adding the WinXP machine to the Samba PDC and without using ntlm_auth. Any help will be much appreciated.
Maybe. It's not a common use-case. There should be an account in the domain of MACHINENAME$ - it should have an ntPassword LDAP attribute (or whatever it's called in your schema). If you setup the FreeRadius LDAP module to correctly extract the ntPassword attribute and add it as an NT-Password configure item, I don't see any reason the FreeRadius ms-chap module wouldn't work. So, something like: modules { mschap { } ldap { # configure LDAP here } } authorize { preprocess mschap eap ldap } authenticate { Auth-Type MS-CHAP { mschap } eap } The "configure LDAP here" should be fairly straightforward - read the default configuration and unless you have a non-standard setup things should work. Things you might have to alter: 1. If your LDAP schema puts the NT hash in an attribute other than ntPassword, edit the "ldap.attrmap" file 2. If your LDAP schema does not contain the ntPassword but uses the Novell eDir "universal password" stuff (I'm not sure how that would work as a samba backend, so I doubt it) read the comments about setting up eDir in the default radiusd.conf Other possible issues - the machine may announce itself as "HOST/MACHINENAME" in which case you need to fix that - see posts on the mailing list about using the "hints" file to strip the host/ and append a $ but I can't find them because the FreeRadius archives are unsearchable (every "help me" post with FR debug output contains those strings!)
Regards, -Sayantan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Thanks for the replies. Regards, -Sayantan
On Mon, Jan 30, 2006 at 6:55 pm, in message <43DE13C1.8000802@imperial.ac.uk>, p.mayers@imperial.ac.uk wrote: Sayantan Bhowmick wrote: HI, I am trying a similar setup with some variation.
If there is no PDC, there's no domain, so there *is* no machine account.
I have setup a Samba PDC and am using Novell eDirectory as the back- end store. In this scenario is it possible to perform PEAP- MSCHAPv2 machine authentication by adding the WinXP machine to the Samba PDC and without using ntlm_auth. Any help will be much appreciated.
Maybe. It's not a common use- case.
There should be an account in the domain of MACHINENAME$ - it should
have an ntPassword LDAP attribute (or whatever it's called in your schema). If you setup the FreeRadius LDAP module to correctly extract
the ntPassword attribute and add it as an NT- Password configure item, I don't see any reason the FreeRadius ms- chap module wouldn't work.
So, something like:
modules { mschap { } ldap { # configure LDAP here } } authorize { preprocess mschap eap ldap } authenticate { Auth- Type MS- CHAP { mschap } eap }
The "configure LDAP here" should be fairly straightforward - read the default configuration and unless you have a non- standard setup things should work.
Things you might have to alter:
1. If your LDAP schema puts the NT hash in an attribute other than
ntPassword, edit the "ldap.attrmap" file 2. If your LDAP schema does not contain the ntPassword but uses the
Novell eDir "universal password" stuff (I'm not sure how that would work as a samba backend, so I doubt it) read the comments about setting up
eDir in the default radiusd.conf
Other possible issues - the machine may announce itself as "HOST/MACHINENAME" in which case you need to fix that - see posts on the mailing list about using the "hints" file to strip the host/ and append a $ but I can't find them because the FreeRadius archives are unsearchable (every "help me" post with FR debug output contains those strings!)
Regards, - Sayantan - List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Jérémy Cluzel -
Phil Mayers -
Sayantan Bhowmick