Hi, I would like to use FreeRADIUS on either Debian or FreeBSD stable for VPN user authentication. Authentication should be based on the following information: a) username+MIT Kerberos password b) MAC address of the machine c) OTP generated by e.g. a Yubikey device d) (possibly) a client certificate or a public/private key pair (either created by SSH or GPG) (The combination of b) and d) would uniquely identify the machine; the combination of a) and c) would uniquely identify the user). I would like to store this information in LDAP DIT (served by OpenLDAP). Up to now, I've only used OpenLDAP for POSIX+Samba account info und MIT Kerberos related data. My questions are: - Is there any current documentation for such a (or a quite similar) scenario? Up to now, one documentation I found was http://vuksan.com/linux/dot1x/802-1x-LDAP.html but this one is related to MAC authentication for WLAN setups - Are there any web frontends and/or GUI frontends offering support for the RADIUS schema? Thanks in advance for any info and kind regards, Holger
I don't what you are looking for, but you can use phpldapadmin to configure the radius attributes for your LDAP service Regards -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-Frontend-with-Support-for-RADIU... Sent from the FreeRadius - User mailing list archive at Nabble.com.
Hi, thanks a lot for your reply. But apart for a suggestion for the LDAP frontend, I was also looking for a documentation on how FreeRADIUS can be used in conjunction with OpenLDAP for authenticating VPN users. Furthermore, the comments on the precise meaning of the RADIUS related LDAP attributes in the corresponding LDAP schema is rather terse. Is there any documentation covering the meaning of those attributes in greater detail, especially in the context of authenticating VPN users via a combination of means I mentioned in previous mail? Thanks in advance for any hints/pointers. Kind regards, Holger 2010/11/7 snowman5840 <snowman5840@t-online.de>
I don't what you are looking for, but you can use phpldapadmin to configure the radius attributes for your LDAP service
Regards -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-Frontend-with-Support-for-RADIU... Sent from the FreeRadius - User mailing list archive at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Holger Rauch wrote:
thanks a lot for your reply. But apart for a suggestion for the LDAP frontend, I was also looking for a documentation on how FreeRADIUS can be used in conjunction with OpenLDAP for authenticating VPN users.
LDAP stores usernames and passwords. FreeRADIUS looks up usernames in LDAP, obtains the "known good" password, and authenticates the user. The server comes with detailed examples, and documented configuration files. See raddb/modules/ldap.
Furthermore, the comments on the precise meaning of the RADIUS related LDAP attributes in the corresponding LDAP schema is rather terse.
Yes. They map data in LDAP to RADIUS attributes. The meaning of the RADIUS attributes is defined in the RFCs.
Is there any documentation covering the meaning of those attributes in greater detail, especially in the context of authenticating VPN users via a combination of means I mentioned in previous mail?
Nearly all of those attributes are *authorization* related. i.e. VLAN assignment, etc. As a result, they have very little to do with *authentication*. In your case, configure FreeRADIUS to use LDAP, and the VPN users will be authenticated. If you need specific authorization attributes, see the VPN documentation for what is needed, and then configure FreeRADIUS to return those. (Or put them into LDAP, and FreeRADIUS will automatically return them.) Alan DeKok.
participants (3)
-
Alan DeKok -
Holger Rauch -
snowman5840