Re: Is LDAP + EAP Possible For Me?
Will your LDAP server give FreeRADIUS the cleartext password, or the NTLM password? I'm using eDirectory, and I do not think my passwords are clear text. Surprisingly, when I put in a ticket asking Novell about it, the engineer seemed to know nothing about configuring eDir for clear text. It looks like my best bet is probably TTLS/PAP. Is there a good guide that you would recommend for getting that set up, or should I just start googling. I really appreciate the pointers, by the way.
Ethan Chrisawn Systems Administrator www.ecrs.com echrisawn@ecrs.com Phone: 828.265.2907 ext:5018
I'm using eDirectory, and I do not think my passwords are clear text. Surprisingly, when I put in a ticket asking Novell about it, the engineer seemed to know nothing about configuring eDir for clear text. It looks like my best bet is probably TTLS/PAP. Is there a good guide that you would recommend for getting that set up, or should I just start googling.
With eDirectory you can do EAP, yes. However, you will need to use LDAPS and enable the Universal Password feature in eDirectory. There are others on this list who are more qualified than I to comment on how to use eDirectory with EAP authentication in FreeRADIUS, so no doubt someone will pipe up, but yes, it is possible. Stefan Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238
Hi,
However, you will need to use LDAPS and enable the Universal Password feature in eDirectory. There are others on this list who are more qualified than I to comment on how to use eDirectory with EAP authentication in FreeRADIUS, so no doubt someone will pipe up, but yes, it is possible.
its an old crunch document....but I think its still pretty much applicable..just forget it says freeradius 1.0.x!!! ;-) http://freeradius.org/doc/radiusadmin.pdf alan
Thanks for the document, I'll give this a shot! Ethan Chrisawn Systems Administrator www.ecrs.com echrisawn@ecrs.com Phone: 828.265.2907 ext:5018
<A.L.M.Buxey@lboro.ac.uk> 4/15/2014 11:12 AM >>> Hi,
However, you will need to use LDAPS and enable the Universal Password feature in eDirectory. There are others on this list who are more qualified than I to comment on how to use eDirectory with EAP authentication in FreeRADIUS, so no doubt someone will pipe up, but yes, it is possible.
its an old crunch document....but I think its still pretty much applicable..just forget it says freeradius 1.0.x!!! ;-) http://freeradius.org/doc/radiusadmin.pdf alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Ethan! Heres the new documentation: https://www.netiq.com/documentation/edir_radius/ and http://www.novell.com/coolsolutions/feature/15383.html A tipp from me: When enabling universal passwords in edir the universal password per user is only available if the password has been changed after that. Ciao Anja
"Ethan Chrisawn" <echrisawn@ecrsoft.com> 15.04.2014 18:04 >>> Thanks for the document, I'll give this a shot!
Ethan Chrisawn Systems Administrator www.ecrs.com echrisawn@ecrs.com Phone: 828.265.2907 ext:5018
<A.L.M.Buxey@lboro.ac.uk> 4/15/2014 11:12 AM >>> Hi,
However, you will need to use LDAPS and enable the Universal Password feature in eDirectory. There are others on this list who are more qualified than I to comment on how to use eDirectory with EAP authentication in FreeRADIUS, so no doubt someone will pipe up, but yes, it is possible.
its an old crunch document....but I think its still pretty much applicable..just forget it says freeradius 1.0.x!!! ;-) http://freeradius.org/doc/radiusadmin.pdf alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
This is great, Thanks so much! Ethan Chrisawn Systems Administrator www.ecrs.com echrisawn@ecrs.com Phone: 828.265.2907 ext:5018
"Anja Ruckdaeschel" <Anja.Ruckdaeschel@rz.uni-regensburg.de> 4/29/2014 2:39 PM >>> Hi Ethan!
Heres the new documentation: https://www.netiq.com/documentation/edir_radius/ and http://www.novell.com/coolsolutions/feature/15383.html A tipp from me: When enabling universal passwords in edir the universal password per user is only available if the password has been changed after that. Ciao Anja
"Ethan Chrisawn" <echrisawn@ecrsoft.com> 15.04.2014 18:04 >>> Thanks for the document, I'll give this a shot!
Ethan Chrisawn Systems Administrator www.ecrs.com echrisawn@ecrs.com Phone: 828.265.2907 ext:5018
<A.L.M.Buxey@lboro.ac.uk> 4/15/2014 11:12 AM >>> Hi,
However, you will need to use LDAPS and enable the Universal Password feature in eDirectory. There are others on this list who are more qualified than I to comment on how to use eDirectory with EAP authentication in FreeRADIUS, so no doubt someone will pipe up, but yes, it is possible.
its an old crunch document....but I think its still pretty much applicable..just forget it says freeradius 1.0.x!!! ;-) http://freeradius.org/doc/radiusadmin.pdf alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Anja, Are you saying that if universal password will not enable it for existing users who are not changing their passwords? That sucks. :-/ But thanks for pointing this out. This will be useful in the future. Alan D, perhaps this could be an FAQ for the Wiki? I'll try to add one… Stefan ________________________________________ From: freeradius-users-bounces+stefan.paetow=ja.net@lists.freeradius.org [freeradius-users-bounces+stefan.paetow=ja.net@lists.freeradius.org] on behalf of Anja Ruckdaeschel [Anja.Ruckdaeschel@rz.uni-regensburg.de] Sent: 29 April 2014 19:39 To: FreeRadius users mailing list Subject: Antw: Re: Is LDAP + EAP Possible For Me? Hi Ethan! Heres the new documentation: https://www.netiq.com/documentation/edir_radius/ and http://www.novell.com/coolsolutions/feature/15383.html A tipp from me: When enabling universal passwords in edir the universal password per user is only available if the password has been changed after that. Ciao Anja
"Ethan Chrisawn" <echrisawn@ecrsoft.com> 15.04.2014 18:04 >>> Thanks for the document, I'll give this a shot!
Ethan Chrisawn Systems Administrator www.ecrs.com echrisawn@ecrs.com Phone: 828.265.2907 ext:5018
<A.L.M.Buxey@lboro.ac.uk> 4/15/2014 11:12 AM >>> Hi,
However, you will need to use LDAPS and enable the Universal Password feature in eDirectory. There are others on this list who are more qualified than I to comment on how to use eDirectory with EAP authentication in FreeRADIUS, so no doubt someone will pipe up, but yes, it is possible.
its an old crunch document....but I think its still pretty much applicable..just forget it says freeradius 1.0.x!!! ;-) http://freeradius.org/doc/radiusadmin.pdf alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238
Dear Alan, it´s a little mor complicated.... Like https://www.netiq.com/documentation/edir_radius/radiusadmin/data/bxxer30.htm... says: "Enabling Universal Password for eDirectory Users Ensure that you enable Universal Password for the users in eDirectory. After enabling, you need to set the Universal Password either manually or by logging in. " Basic concept is, that you have to trigger the sync from the NDS password (Hash) to the universal passsword store per user, partitiion or tree, ... That´s e.g. also possible wih a Novell Client Login with NMAS enabled, but a password change does always do a password sync. Just wanted to point out the way working for the most edir setups.... But all of that is depending from how you want to have your policies, use your passwords and which methods you use.... e.g. you can also do a no sync policy between those passwords.... as you like it. See also: https://www.netiq.com/documentation/edir88/pwm_administration88/data/alpcc1q... https://www.netiq.com/documentation/edir88/pwm_administration88/data/alpccs8... and https://www.netiq.com/documentation/edir88/pwm_administration88/data/alpccv4... Ciao Anja
<A.L.M.Buxey@lboro.ac.uk> 29.04.2014 23:27 >>> Hi,
Are you saying that if universal password will not enable it for existing users who are not changing their passwords? That sucks. :-/
interesting - its not something I've seen - UP gets turned on, things just work(tm) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ahhhh, So the users have to log into NDS at least once to populate their Universal Password before they attempt to authenticate through RADIUS. Do I understand that correctly? Stefan -----Original Message----- From: freeradius-users-bounces+stefan.paetow=ja.net@lists.freeradius.org [mailto:freeradius-users-bounces+stefan.paetow=ja.net@lists.freeradius.org] On Behalf Of Anja Ruckdaeschel Sent: 30 April 2014 09:27 To: FreeRadius users mailing list Subject: Re: Antw: Re: Is LDAP + EAP Possible For Me? Dear Alan, it´s a little mor complicated.... Like https://www.netiq.com/documentation/edir_radius/radiusadmin/data/bxxer30.htm... says: "Enabling Universal Password for eDirectory Users Ensure that you enable Universal Password for the users in eDirectory. After enabling, you need to set the Universal Password either manually or by logging in. " Basic concept is, that you have to trigger the sync from the NDS password (Hash) to the universal passsword store per user, partitiion or tree, ... That´s e.g. also possible wih a Novell Client Login with NMAS enabled, but a password change does always do a password sync. Just wanted to point out the way working for the most edir setups.... But all of that is depending from how you want to have your policies, use your passwords and which methods you use.... e.g. you can also do a no sync policy between those passwords.... as you like it. See also: https://www.netiq.com/documentation/edir88/pwm_administration88/data/alpcc1q... https://www.netiq.com/documentation/edir88/pwm_administration88/data/alpccs8... and https://www.netiq.com/documentation/edir88/pwm_administration88/data/alpccv4... Ciao Anja
<A.L.M.Buxey@lboro.ac.uk> 29.04.2014 23:27 >>> Hi,
Are you saying that if universal password will not enable it for existing users who are not changing their passwords? That sucks. :-/
interesting - its not something I've seen - UP gets turned on, things just work(tm) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238
With Novell Client and NMAs enabled, yes. But that's not the case for every type of login (e.g. *not* with a LDAP Login without NMAS, but with a Novell Client Login with NMAS enabled). Please see the NetIQ-Docs for the possible "permutations"of passwords and systems.... it depends on your individual edir configuration and policy deploy how the passwords are synced (or even not synced). I think, most people use a completely password synced setup, so they need ways to sync the passwords in their edir....
Stefan Paetow <Stefan.Paetow@ja.net> 30.04.2014 10:45 >>> Ahhhh,
So the users have to log into NDS at least once to populate their Universal Password before they attempt to authenticate through RADIUS. Do I understand that correctly? Stefan -----Original Message----- From: freeradius-users-bounces+stefan.paetow=ja.net@lists.freeradius.org [mailto:freeradius-users-bounces+stefan.paetow=ja.net@lists.freeradius.org] On Behalf Of Anja Ruckdaeschel Sent: 30 April 2014 09:27 To: FreeRadius users mailing list Subject: Re: Antw: Re: Is LDAP + EAP Possible For Me? Dear Alan, it´s a little mor complicated.... Like https://www.netiq.com/documentation/edir_radius/radiusadmin/data/bxxer30.htm... says: "Enabling Universal Password for eDirectory Users Ensure that you enable Universal Password for the users in eDirectory. After enabling, you need to set the Universal Password either manually or by logging in. " Basic concept is, that you have to trigger the sync from the NDS password (Hash) to the universal passsword store per user, partitiion or tree, ... That´s e.g. also possible wih a Novell Client Login with NMAS enabled, but a password change does always do a password sync. Just wanted to point out the way working for the most edir setups.... But all of that is depending from how you want to have your policies, use your passwords and which methods you use.... e.g. you can also do a no sync policy between those passwords.... as you like it. See also: https://www.netiq.com/documentation/edir88/pwm_administration88/data/alpcc1q... https://www.netiq.com/documentation/edir88/pwm_administration88/data/alpccs8... and https://www.netiq.com/documentation/edir88/pwm_administration88/data/alpccv4... Ciao Anja
<A.L.M.Buxey@lboro.ac.uk> 29.04.2014 23:27 >>> Hi,
Are you saying that if universal password will not enable it for existing users who are not changing their passwords? That sucks. :-/
interesting - its not something I've seen - UP gets turned on, things just work(tm) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Are you saying that universal password will not enable for existing users who are not changing their passwords? That sucks. :-/ interesting - its not something I've seen - UP gets turned on, things just work(tm)
Is it possibly a problem with specific versions? :-/ Stefan Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Anja Ruckdaeschel -
Ethan Chrisawn -
Stefan Paetow