I am running AD in native mode. By my ancient understanding of samba, I cannot join this domain. I can authenticate using ldap, no? Also, is this insecure due to clear text? Any other ideas for what I want here? Thanks!
Frank Smith wrote:
I am running AD in native mode. By my ancient understanding of samba, I cannot join this domain.
That is not correct, and is indeed ancient. Samba 3 can join an AD native-mode domain. See the massive quantity of docs include with samba. Once in the domain, the winbind daemon can be started and the ntlm_auth helper used to answer MS-CHAP requests.
I can authenticate using ldap, no? Also, is
LDAP can only service PAP requests. If you want PAP, LDAP works fine. If you want to do e.g. wireless authentication with PEAP/MS-CHAP or dialup using MS-CHAP, you must join the domain.
Hi,
Frank Smith wrote:
I am running AD in native mode. By my ancient understanding of samba, I cannot join this domain.
That is not correct, and is indeed ancient. Samba 3 can join an AD native-mode domain. See the massive quantity of docs include with samba. Once in the domain, the winbind daemon can be started and the ntlm_auth helper used to answer MS-CHAP requests.
perhaps this might help: http://www.mpking.com/articles.php?lng=en&pg=55 alan
Thanks for all your replies. This is simply to do 802.1x authentication. Nothing to do with wireless. This is my first whack at radius all together. Based on what you guys are saying, it sounds like Radius -> Pam -> Pam-LDAP -> Active Directory sounds like the way to go. Any objections? On 5/8/06, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
Frank Smith wrote:
I am running AD in native mode. By my ancient understanding of samba, I cannot join this domain.
That is not correct, and is indeed ancient. Samba 3 can join an AD native-mode domain. See the massive quantity of docs include with samba. Once in the domain, the winbind daemon can be started and the ntlm_auth helper used to answer MS-CHAP requests.
I can authenticate using ldap, no? Also, is
LDAP can only service PAP requests. If you want PAP, LDAP works fine.
If you want to do e.g. wireless authentication with PEAP/MS-CHAP or dialup using MS-CHAP, you must join the domain. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
"Frank Smith" <fds0000@gmail.com> wrote:
Based on what you guys are saying, it sounds like Radius -> Pam -> Pam-LDAP -> Active Directory sounds like the way to go. Any objections?
There's no need to use PAM. FreeRADIUS has an LDAP module that works. Everything PAM can do to Active Directory, FreeRADIUS can do natively. i.e. PAP. In order to do mschap to AD, you need Samba & ntlm_auth. PAM won't help. Alan DeKok.
Frank Smith wrote:
Thanks for all your replies. This is simply to do 802.1x authentication. Nothing to do with wireless. This is my first whack at radius all together. Based on what you guys are saying, it sounds like Radius -> Pam -> Pam-LDAP -> Active Directory sounds like the way to go. Any objections?
If you are using the standard windows XP supplicant, LDAP will not support any of the mechanisms available. The mechs are the same as on the wireless side and are: 1. EAP-MD5 - requires IAS and reversible passwords on the DC 2. MS-CHAP - requires samba/ntlm_auth 3. EAP-TLS - requires certificates, does not need nor can use LDAP 4. EAP-PEAP+MS-CHAP - as per 2 So LDAP will not help you. There is no EAP-PAP in XP, nor EAP-PEAP+GTC.
hi, i suggest EAP/PEAP MS-CHAPv2 with ntlm authentication. bye Frank Smith wrote:
Thanks for all your replies. This is simply to do 802.1x authentication. Nothing to do with wireless. This is my first whack at radius all together. Based on what you guys are saying, it sounds like Radius -> Pam -> Pam-LDAP -> Active Directory sounds like the way to go. Any objections?
On 5/8/06, *Phil Mayers* <p.mayers@imperial.ac.uk <mailto:p.mayers@imperial.ac.uk>> wrote:
Frank Smith wrote: > I am running AD in native mode. By my ancient understanding of samba, I > cannot join this domain.
That is not correct, and is indeed ancient. Samba 3 can join an AD native-mode domain. See the massive quantity of docs include with samba. Once in the domain, the winbind daemon can be started and the ntlm_auth helper used to answer MS-CHAP requests.
> I can authenticate using ldap, no? Also, is
LDAP can only service PAP requests. If you want PAP, LDAP works fine.
If you want to do e.g. wireless authentication with PEAP/MS-CHAP or dialup using MS-CHAP, you must join the domain. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
------------------------------------------------------------------------
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Frank Smith -
Konne -
Phil Mayers