Dear, I'm advancing in the Freeradius + AD authentication....just a short question: when I want to make the eapol_test tool, I get this error: # make eapol_test /usr/bin/ld: cannot find -lnl collect2: error: ld returned 1 exit status make: *** [eapol_test] Error 1 I've followed all the steps to use this tool, but I can't make it. What can be the problem ??? Thanks 2013/9/24 <stefan.paetow@diamond.ac.uk>:
Hi Roberto,
You have to install Kerberos, yes. I believe you'll need the krb5-user package.
When you install krb5-user, it should install krb5.conf for you, but I'm not up to date on Debian specifically.
Stefan
-----Original Message----- From: Roberto Carna [mailto:robertocarna36@gmail.com] Sent: 23 September 2013 19:16 To: Paetow, Stefan (DLSLtd,RAL,LSCI) Subject: Re: Active Directory authentication question
Dear Stepahn, I use Debian 7 for my Freeradius server and there I've installed Samba, Winbind and krb5.conf....not Kerberos (or whatever the package is called).
Do I need to install the Kerberos package, or simply install the krb5.conf and then edit it ???
Thanks again.
Roberto
2013/9/23 <stefan.paetow@diamond.ac.uk>:
Hi Roberto,
When in the process do you get that error?
Here are my configuration bits. In the [global] section of the SMB.CONF file I have:
workgroup = DIAMOND security = ads realm = DIAMOND.LOCAL (my test domain) password server = IP address of my primary domain controller
Everything else is left as-is (default). My test domain is called DIAMOND.LOCAL.
Stefan
-----Original Message----- From: Roberto Carna [mailto:robertocarna36@gmail.com] Sent: 23 September 2013 15:58 To: Paetow, Stefan (DLSLtd,RAL,LSCI) Subject: Re: Active Directory authentication question
Dear Stephan, can you send me a complete smb.conf file because I am a bit lost in the correct configuration ?
I'm getting the error:
Could not connect to server 10.11.0.64 Connection failed: NT_STATUS_BAD_NETWORK_NAME
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
Roberto Carna wrote:
Dear, I'm advancing in the Freeradius + AD authentication....just a short question: when I want to make the eapol_test tool, I get this error:
# make eapol_test /usr/bin/ld: cannot find -lnl collect2: error: ld returned 1 exit status make: *** [eapol_test] Error 1
I've followed all the steps to use this tool, but I can't make it.
What can be the problem ???
You do realize that eapol_test isn't part of FreeRADIUS, right? Please ask the eapol_test authors how to fix it. Alan DeKok.
You need the following items on your Debian system to build eapol_test: libssl-dev, libnl1, libnl-dev :-) Stefan
-----Original Message----- From: freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] On Behalf Of Roberto Carna Sent: 24 September 2013 15:17 To: FreeRadius users mailing list Subject: Re: Active Directory authentication question
Dear, I'm advancing in the Freeradius + AD authentication....just a short question: when I want to make the eapol_test tool, I get this error:
# make eapol_test /usr/bin/ld: cannot find -lnl collect2: error: ld returned 1 exit status make: *** [eapol_test] Error 1
I've followed all the steps to use this tool, but I can't make it.
What can be the problem ???
Thanks
2013/9/24 <stefan.paetow@diamond.ac.uk>:
Hi Roberto,
You have to install Kerberos, yes. I believe you'll need the krb5- user package.
When you install krb5-user, it should install krb5.conf for you, but I'm not up to date on Debian specifically.
Stefan
-----Original Message----- From: Roberto Carna [mailto:robertocarna36@gmail.com] Sent: 23 September 2013 19:16 To: Paetow, Stefan (DLSLtd,RAL,LSCI) Subject: Re: Active Directory authentication question
Dear Stepahn, I use Debian 7 for my Freeradius server and there I've installed Samba, Winbind and krb5.conf....not Kerberos (or whatever the package is called).
Do I need to install the Kerberos package, or simply install the krb5.conf and then edit it ???
Thanks again.
Roberto
2013/9/23 <stefan.paetow@diamond.ac.uk>:
Hi Roberto,
When in the process do you get that error?
Here are my configuration bits. In the [global] section of the SMB.CONF file I have:
workgroup = DIAMOND security = ads realm = DIAMOND.LOCAL (my test domain) password server = IP address of my primary domain controller
Everything else is left as-is (default). My test domain is called DIAMOND.LOCAL.
Stefan
-----Original Message----- From: Roberto Carna [mailto:robertocarna36@gmail.com] Sent: 23 September 2013 15:58 To: Paetow, Stefan (DLSLtd,RAL,LSCI) Subject: Re: Active Directory authentication question
Dear Stephan, can you send me a complete smb.conf file because I am a bit lost in the correct configuration ?
I'm getting the error:
Could not connect to server 10.11.0.64 Connection failed: NT_STATUS_BAD_NETWORK_NAME
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
Dear Stephan, just the last question please....in your guide you say: In /etc/raddb/eap.conf, change the ttls section as follows: default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = no That's OK....but what do I have to put in the eap section from eap.conf file??? eap { default_eap_type = ttls default_eap_type=ttls or =mschapv2 ??? Thanks a lot, Roberto 2013/9/24 <stefan.paetow@diamond.ac.uk>:
You need the following items on your Debian system to build eapol_test:
libssl-dev, libnl1, libnl-dev
:-)
Stefan
-----Original Message----- From: freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] On Behalf Of Roberto Carna Sent: 24 September 2013 15:17 To: FreeRadius users mailing list Subject: Re: Active Directory authentication question
Dear, I'm advancing in the Freeradius + AD authentication....just a short question: when I want to make the eapol_test tool, I get this error:
# make eapol_test /usr/bin/ld: cannot find -lnl collect2: error: ld returned 1 exit status make: *** [eapol_test] Error 1
I've followed all the steps to use this tool, but I can't make it.
What can be the problem ???
Thanks
2013/9/24 <stefan.paetow@diamond.ac.uk>:
Hi Roberto,
You have to install Kerberos, yes. I believe you'll need the krb5- user package.
When you install krb5-user, it should install krb5.conf for you, but I'm not up to date on Debian specifically.
Stefan
-----Original Message----- From: Roberto Carna [mailto:robertocarna36@gmail.com] Sent: 23 September 2013 19:16 To: Paetow, Stefan (DLSLtd,RAL,LSCI) Subject: Re: Active Directory authentication question
Dear Stepahn, I use Debian 7 for my Freeradius server and there I've installed Samba, Winbind and krb5.conf....not Kerberos (or whatever the package is called).
Do I need to install the Kerberos package, or simply install the krb5.conf and then edit it ???
Thanks again.
Roberto
2013/9/23 <stefan.paetow@diamond.ac.uk>:
Hi Roberto,
When in the process do you get that error?
Here are my configuration bits. In the [global] section of the SMB.CONF file I have:
workgroup = DIAMOND security = ads realm = DIAMOND.LOCAL (my test domain) password server = IP address of my primary domain controller
Everything else is left as-is (default). My test domain is called DIAMOND.LOCAL.
Stefan
-----Original Message----- From: Roberto Carna [mailto:robertocarna36@gmail.com] Sent: 23 September 2013 15:58 To: Paetow, Stefan (DLSLtd,RAL,LSCI) Subject: Re: Active Directory authentication question
Dear Stephan, can you send me a complete smb.conf file because I am a bit lost in the correct configuration ?
I'm getting the error:
Could not connect to server 10.11.0.64 Connection failed: NT_STATUS_BAD_NETWORK_NAME
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
In the eap section, the default is "md5", set it to "ttls" And Roberto, you've emailed the entire FreeRADIUS mailing list. :-) Stefan
-----Original Message----- From: freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] On Behalf Of Roberto Carna Sent: 25 September 2013 14:27 To: FreeRadius users mailing list Subject: Re: Active Directory authentication question
Dear Stephan, just the last question please....in your guide you say:
In /etc/raddb/eap.conf, change the ttls section as follows:
default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = no
That's OK....but what do I have to put in the eap section from eap.conf file???
eap { default_eap_type = ttls
default_eap_type=ttls or =mschapv2 ???
Thanks a lot,
Roberto
You need the following items on your Debian system to build eapol_test:
libssl-dev, libnl1, libnl-dev
:-)
Stefan
-----Original Message----- From: freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] On Behalf bounces+Of Roberto Carna Sent: 24 September 2013 15:17 To: FreeRadius users mailing list Subject: Re: Active Directory authentication question
Dear, I'm advancing in the Freeradius + AD authentication....just a short question: when I want to make the eapol_test tool, I get this error:
# make eapol_test /usr/bin/ld: cannot find -lnl collect2: error: ld returned 1 exit status make: *** [eapol_test] Error 1
I've followed all the steps to use this tool, but I can't make it.
What can be the problem ???
Thanks
2013/9/24 <stefan.paetow@diamond.ac.uk>:
Hi Roberto,
You have to install Kerberos, yes. I believe you'll need the krb5- user package.
When you install krb5-user, it should install krb5.conf for you, but I'm not up to date on Debian specifically.
Stefan
-----Original Message----- From: Roberto Carna [mailto:robertocarna36@gmail.com] Sent: 23 September 2013 19:16 To: Paetow, Stefan (DLSLtd,RAL,LSCI) Subject: Re: Active Directory authentication question
Dear Stepahn, I use Debian 7 for my Freeradius server and there I've installed Samba, Winbind and krb5.conf....not Kerberos (or whatever the package is called).
Do I need to install the Kerberos package, or simply install the krb5.conf and then edit it ???
Thanks again.
Roberto
2013/9/23 <stefan.paetow@diamond.ac.uk>:
Hi Roberto,
When in the process do you get that error?
Here are my configuration bits. In the [global] section of the SMB.CONF file I have:
workgroup = DIAMOND security = ads realm = DIAMOND.LOCAL (my test domain) password server = IP address of my primary domain controller
Everything else is left as-is (default). My test domain is called DIAMOND.LOCAL.
Stefan
> -----Original Message----- > From: Roberto Carna [mailto:robertocarna36@gmail.com] > Sent: 23 September 2013 15:58 > To: Paetow, Stefan (DLSLtd,RAL,LSCI) > Subject: Re: Active Directory authentication question > > Dear Stephan, can you send me a complete smb.conf file because > I am a > bit lost in the correct configuration ? > > I'm getting the error: > > Could not connect to server 10.11.0.64 Connection failed: > NT_STATUS_BAD_NETWORK_NAME
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
2013/9/24 <stefan.paetow@diamond.ac.uk>: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
Dear Stephan: Notebook with Windows 7 + AP + EAP-TTLS + MSCHAPv2 + Freeradius + AD is working now !!! But just a doubt: if I access with my Android device, using EAP-TLS (not EAP-TTLS) + MSCHAPv2, I can access the same...why ??? Regards and thanks, Roberto 2013/9/25 <stefan.paetow@diamond.ac.uk>:
In the eap section, the default is "md5", set it to "ttls"
And Roberto, you've emailed the entire FreeRADIUS mailing list. :-)
Stefan
-----Original Message----- From: freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] On Behalf Of Roberto Carna Sent: 25 September 2013 14:27 To: FreeRadius users mailing list Subject: Re: Active Directory authentication question
Dear Stephan, just the last question please....in your guide you say:
In /etc/raddb/eap.conf, change the ttls section as follows:
default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = no
That's OK....but what do I have to put in the eap section from eap.conf file???
eap { default_eap_type = ttls
default_eap_type=ttls or =mschapv2 ???
Thanks a lot,
Roberto
You need the following items on your Debian system to build eapol_test:
libssl-dev, libnl1, libnl-dev
:-)
Stefan
-----Original Message----- From: freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] On Behalf bounces+Of Roberto Carna Sent: 24 September 2013 15:17 To: FreeRadius users mailing list Subject: Re: Active Directory authentication question
Dear, I'm advancing in the Freeradius + AD authentication....just a short question: when I want to make the eapol_test tool, I get this error:
# make eapol_test /usr/bin/ld: cannot find -lnl collect2: error: ld returned 1 exit status make: *** [eapol_test] Error 1
I've followed all the steps to use this tool, but I can't make it.
What can be the problem ???
Thanks
2013/9/24 <stefan.paetow@diamond.ac.uk>:
Hi Roberto,
You have to install Kerberos, yes. I believe you'll need the krb5- user package.
When you install krb5-user, it should install krb5.conf for you, but I'm not up to date on Debian specifically.
Stefan
-----Original Message----- From: Roberto Carna [mailto:robertocarna36@gmail.com] Sent: 23 September 2013 19:16 To: Paetow, Stefan (DLSLtd,RAL,LSCI) Subject: Re: Active Directory authentication question
Dear Stepahn, I use Debian 7 for my Freeradius server and there I've installed Samba, Winbind and krb5.conf....not Kerberos (or whatever the package is called).
Do I need to install the Kerberos package, or simply install the krb5.conf and then edit it ???
Thanks again.
Roberto
2013/9/23 <stefan.paetow@diamond.ac.uk>: > Hi Roberto, > > When in the process do you get that error? > > Here are my configuration bits. In the [global] section of the SMB.CONF file I have: > > workgroup = DIAMOND > security = ads > realm = DIAMOND.LOCAL (my test domain) password server = IP address of > my primary domain controller > > Everything else is left as-is (default). My test domain is > called DIAMOND.LOCAL. > > Stefan > > > > > >> -----Original Message----- >> From: Roberto Carna [mailto:robertocarna36@gmail.com] >> Sent: 23 September 2013 15:58 >> To: Paetow, Stefan (DLSLtd,RAL,LSCI) >> Subject: Re: Active Directory authentication question >> >> Dear Stephan, can you send me a complete smb.conf file because >> I am a >> bit lost in the correct configuration ? >> >> I'm getting the error: >> >> Could not connect to server 10.11.0.64 Connection failed: >> NT_STATUS_BAD_NETWORK_NAME > > > > -- > This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. > Any opinions expressed within this e-mail are those of the > individual and not necessarily of Diamond Light Source Ltd. > Diamond Light Source Ltd. cannot guarantee that this e-mail or > any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. > Diamond Light Source Limited (company no. 4375679). Registered > in England and Wales with its registered office at Diamond > House, Harwell > Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, > United Kingdom > > > >
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
2013/9/24 <stefan.paetow@diamond.ac.uk>: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Because your EAP-TLS process works? Remember, you set up EAP-TLS first (which worked). You just configured EAP-TTLS with EAP-MSCHAPv2 as an additional authentication method. Since the default_eap_type is set to ttls, your server *prefers* using EAP-TTLS with EAP-MSCHAPv2, but it still supports other methods (like EAP-TLS and PEAP with EAP-MSCHAPv2). Stefan
-----Original Message----- From: freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] On Behalf Of Roberto Carna Sent: 25 September 2013 15:44 To: FreeRadius users mailing list Subject: Re: Active Directory authentication question
Dear Stephan: Notebook with Windows 7 + AP + EAP-TTLS + MSCHAPv2 + Freeradius + AD is working now !!!
But just a doubt: if I access with my Android device, using EAP-TLS (not EAP-TTLS) + MSCHAPv2, I can access the same...why ???
Regards and thanks,
Roberto
In the eap section, the default is "md5", set it to "ttls"
And Roberto, you've emailed the entire FreeRADIUS mailing list. :-)
Stefan
-----Original Message----- From: freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] On Behalf bounces+Of Roberto Carna Sent: 25 September 2013 14:27 To: FreeRadius users mailing list Subject: Re: Active Directory authentication question
Dear Stephan, just the last question please....in your guide you say:
In /etc/raddb/eap.conf, change the ttls section as follows:
default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = no
That's OK....but what do I have to put in the eap section from eap.conf file???
eap { default_eap_type = ttls
default_eap_type=ttls or =mschapv2 ???
Thanks a lot,
Roberto
You need the following items on your Debian system to build eapol_test:
libssl-dev, libnl1, libnl-dev
:-)
Stefan
-----Original Message----- From: freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] On bounces+Behalf Of Roberto Carna Sent: 24 September 2013 15:17 To: FreeRadius users mailing list Subject: Re: Active Directory authentication question
Dear, I'm advancing in the Freeradius + AD authentication....just a short question: when I want to make the eapol_test tool, I get this error:
# make eapol_test /usr/bin/ld: cannot find -lnl collect2: error: ld returned 1 exit status make: *** [eapol_test] Error 1
I've followed all the steps to use this tool, but I can't make it.
What can be the problem ???
Thanks
2013/9/24 <stefan.paetow@diamond.ac.uk>:
Hi Roberto,
You have to install Kerberos, yes. I believe you'll need the krb5- user package.
When you install krb5-user, it should install krb5.conf for you, but I'm not up to date on Debian specifically.
Stefan
> -----Original Message----- > From: Roberto Carna [mailto:robertocarna36@gmail.com] > Sent: 23 September 2013 19:16 > To: Paetow, Stefan (DLSLtd,RAL,LSCI) > Subject: Re: Active Directory authentication question > > Dear Stepahn, I use Debian 7 for my Freeradius server and there > I've installed Samba, Winbind and krb5.conf....not Kerberos (or > whatever the package is called). > > Do I need to install the Kerberos package, or simply install > the krb5.conf and then edit it ??? > > Thanks again. > > Roberto > > 2013/9/23 <stefan.paetow@diamond.ac.uk>: > > Hi Roberto, > > > > When in the process do you get that error? > > > > Here are my configuration bits. In the [global] section of > > the > SMB.CONF file I have: > > > > workgroup = DIAMOND > > security = ads > > realm = DIAMOND.LOCAL (my test domain) password server = IP address > of > > my primary domain controller > > > > Everything else is left as-is (default). My test domain is > > called > DIAMOND.LOCAL. > > > > Stefan > > > > > > > > > > > >> -----Original Message----- > >> From: Roberto Carna [mailto:robertocarna36@gmail.com] > >> Sent: 23 September 2013 15:58 > >> To: Paetow, Stefan (DLSLtd,RAL,LSCI) > >> Subject: Re: Active Directory authentication question > >> > >> Dear Stephan, can you send me a complete smb.conf file > >> because I am > a > >> bit lost in the correct configuration ? > >> > >> I'm getting the error: > >> > >> Could not connect to server 10.11.0.64 Connection failed: > >> NT_STATUS_BAD_NETWORK_NAME > > > > > > > > -- > > This e-mail and any attachments may contain confidential, copyright > and or privileged material, and are for the use of the intended > addressee only. If you are not the intended addressee or an > authorised recipient of the addressee please notify us of > receipt by returning the e-mail and do not use, copy, retain, > distribute or disclose the information in or attached to the e-mail. > > Any opinions expressed within this e-mail are those of the > > individual > and not necessarily of Diamond Light Source Ltd. > > Diamond Light Source Ltd. cannot guarantee that this e-mail > > or any > attachments are free from viruses and we cannot accept > liability for any damage which you may sustain as a result of > software viruses which may be transmitted in or with the message. > > Diamond Light Source Limited (company no. 4375679). > > Registered in England and Wales with its registered office at > > Diamond House, > Harwell > > Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, > > United Kingdom > > > > > > > >
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
2013/9/24 <stefan.paetow@diamond.ac.uk>: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
2013/9/25 <stefan.paetow@diamond.ac.uk>: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
But in the EAP-TLS section from eap.conf file, I don't see any reference to MSCHAPv2....and remember the NTLM authentication query is set up in the MSCHAPv2 module.... 2013/9/25 <stefan.paetow@diamond.ac.uk>:
Because your EAP-TLS process works? Remember, you set up EAP-TLS first (which worked).
You just configured EAP-TTLS with EAP-MSCHAPv2 as an additional authentication method. Since the default_eap_type is set to ttls, your server *prefers* using EAP-TTLS with EAP-MSCHAPv2, but it still supports other methods (like EAP-TLS and PEAP with EAP-MSCHAPv2).
Stefan
-----Original Message----- From: freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] On Behalf Of Roberto Carna Sent: 25 September 2013 15:44 To: FreeRadius users mailing list Subject: Re: Active Directory authentication question
Dear Stephan: Notebook with Windows 7 + AP + EAP-TTLS + MSCHAPv2 + Freeradius + AD is working now !!!
But just a doubt: if I access with my Android device, using EAP-TLS (not EAP-TTLS) + MSCHAPv2, I can access the same...why ???
Regards and thanks,
Roberto
In the eap section, the default is "md5", set it to "ttls"
And Roberto, you've emailed the entire FreeRADIUS mailing list. :-)
Stefan
-----Original Message----- From: freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] On Behalf bounces+Of Roberto Carna Sent: 25 September 2013 14:27 To: FreeRadius users mailing list Subject: Re: Active Directory authentication question
Dear Stephan, just the last question please....in your guide you say:
In /etc/raddb/eap.conf, change the ttls section as follows:
default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = no
That's OK....but what do I have to put in the eap section from eap.conf file???
eap { default_eap_type = ttls
default_eap_type=ttls or =mschapv2 ???
Thanks a lot,
Roberto
You need the following items on your Debian system to build eapol_test:
libssl-dev, libnl1, libnl-dev
:-)
Stefan
-----Original Message----- From: freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org [mailto:freeradius-users- bounces+stefan.paetow=diamond.ac.uk@lists.freeradius.org] On bounces+Behalf Of Roberto Carna Sent: 24 September 2013 15:17 To: FreeRadius users mailing list Subject: Re: Active Directory authentication question
Dear, I'm advancing in the Freeradius + AD authentication....just a short question: when I want to make the eapol_test tool, I get this error:
# make eapol_test /usr/bin/ld: cannot find -lnl collect2: error: ld returned 1 exit status make: *** [eapol_test] Error 1
I've followed all the steps to use this tool, but I can't make it.
What can be the problem ???
Thanks
2013/9/24 <stefan.paetow@diamond.ac.uk>: > Hi Roberto, > > You have to install Kerberos, yes. I believe you'll need the > krb5- user package. > > When you install krb5-user, it should install krb5.conf for you, > but I'm not up to date on Debian specifically. > > Stefan > > >> -----Original Message----- >> From: Roberto Carna [mailto:robertocarna36@gmail.com] >> Sent: 23 September 2013 19:16 >> To: Paetow, Stefan (DLSLtd,RAL,LSCI) >> Subject: Re: Active Directory authentication question >> >> Dear Stepahn, I use Debian 7 for my Freeradius server and there >> I've installed Samba, Winbind and krb5.conf....not Kerberos (or >> whatever the package is called). >> >> Do I need to install the Kerberos package, or simply install >> the krb5.conf and then edit it ??? >> >> Thanks again. >> >> Roberto >> >> 2013/9/23 <stefan.paetow@diamond.ac.uk>: >> > Hi Roberto, >> > >> > When in the process do you get that error? >> > >> > Here are my configuration bits. In the [global] section of >> > the >> SMB.CONF file I have: >> > >> > workgroup = DIAMOND >> > security = ads >> > realm = DIAMOND.LOCAL (my test domain) password server = IP address >> of >> > my primary domain controller >> > >> > Everything else is left as-is (default). My test domain is >> > called >> DIAMOND.LOCAL. >> > >> > Stefan >> > >> > >> > >> > >> > >> >> -----Original Message----- >> >> From: Roberto Carna [mailto:robertocarna36@gmail.com] >> >> Sent: 23 September 2013 15:58 >> >> To: Paetow, Stefan (DLSLtd,RAL,LSCI) >> >> Subject: Re: Active Directory authentication question >> >> >> >> Dear Stephan, can you send me a complete smb.conf file >> >> because I am >> a >> >> bit lost in the correct configuration ? >> >> >> >> I'm getting the error: >> >> >> >> Could not connect to server 10.11.0.64 Connection failed: >> >> NT_STATUS_BAD_NETWORK_NAME >> > >> > >> > >> > -- >> > This e-mail and any attachments may contain confidential, copyright >> and or privileged material, and are for the use of the intended >> addressee only. If you are not the intended addressee or an >> authorised recipient of the addressee please notify us of >> receipt by returning the e-mail and do not use, copy, retain, >> distribute or disclose the information in or attached to the e-mail. >> > Any opinions expressed within this e-mail are those of the >> > individual >> and not necessarily of Diamond Light Source Ltd. >> > Diamond Light Source Ltd. cannot guarantee that this e-mail >> > or any >> attachments are free from viruses and we cannot accept >> liability for any damage which you may sustain as a result of >> software viruses which may be transmitted in or with the message. >> > Diamond Light Source Limited (company no. 4375679). >> > Registered in England and Wales with its registered office at >> > Diamond House, >> Harwell >> > Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, >> > United Kingdom >> > >> > >> > >> > > > -- > This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. > Any opinions expressed within this e-mail are those of the > individual and not necessarily of Diamond Light Source Ltd. > Diamond Light Source Ltd. cannot guarantee that this e-mail or > any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. > Diamond Light Source Limited (company no. 4375679). Registered > in England and Wales with its registered office at Diamond > House, Harwell > Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, > United Kingdom > > > > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
2013/9/24 <stefan.paetow@diamond.ac.uk>: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
2013/9/25 <stefan.paetow@diamond.ac.uk>: - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
But in the EAP-TLS section from eap.conf file, I don't see any reference to MSCHAPv2....and remember the NTLM authentication query is set up in the MSCHAPv2 module....
EAP-TLS does not use MSCHAPv2. It uses certificates. I quote Alan DeKok's response to your question on September 18:
Dear, I have several Windows 7 clients over WiFi autheticating throug EAP-TLS to a Freeradius 2.1 service against a local MySQL database, it works OK.
EAP-TLS doesn't use MySQL for storing credentials. Everything is in the certificate.
Because I don't know so much about Windows world, I need to know if I have to use NTLM, LDAP or Kerberos in order to authenticate against the remote AD.
For MS-CHAP and PEAP, you use ntlm. You don't have any other choice.
For EAP-TLS, you don't use AD or MySQL.
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
Dear, the Freeradius authentication against AD withn EAP-MSCHAPv2 works OK nowadays. When I login from my notebook, I authenticate my AD credentials and I get an IP from my network.
From my notebook I can navigate the web, but when I want to access a network resource let's say \\moscu\docs, I get the message that my user doesn't have thge appropriate rights.
Is itv possible that the problem is the user I authenticate through Freeradius is roberto and not \\domain\roberto ??? Where can I modify this parameter in order to test ??? Thanks a lot !!! Roberto 2013/9/25 <stefan.paetow@diamond.ac.uk>:
But in the EAP-TLS section from eap.conf file, I don't see any reference to MSCHAPv2....and remember the NTLM authentication query is set up in the MSCHAPv2 module....
EAP-TLS does not use MSCHAPv2. It uses certificates.
I quote Alan DeKok's response to your question on September 18:
Dear, I have several Windows 7 clients over WiFi autheticating throug EAP-TLS to a Freeradius 2.1 service against a local MySQL database, it works OK.
EAP-TLS doesn't use MySQL for storing credentials. Everything is in the certificate.
Because I don't know so much about Windows world, I need to know if I have to use NTLM, LDAP or Kerberos in order to authenticate against the remote AD.
For MS-CHAP and PEAP, you use ntlm. You don't have any other choice.
For EAP-TLS, you don't use AD or MySQL.
-- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Roberto Carna wrote:
From my notebook I can navigate the web, but when I want to access a network resource let's say \\moscu\docs, I get the message that my user doesn't have thge appropriate rights.
Is itv possible that the problem is the user I authenticate through Freeradius is roberto and not \\domain\roberto ???
No. This has nothing to do with FreeRADIUS. Alan DeKok.
On 09/24/2013 10:16 AM, Roberto Carna wrote:
Dear, I'm advancing in the Freeradius + AD authentication....just a short question: when I want to make the eapol_test tool, I get this error:
# make eapol_test /usr/bin/ld: cannot find -lnl collect2: error: ld returned 1 exit status make: *** [eapol_test] Error 1
Basic software development isn't really a topic for this list. You should really look elsewhere for information on how to build and install on your chosen platform. You also need to understand error messages. But just to get you going cannot find -lnl means the linker cannot find the libnl library, therefore you need to install the libnl-devel package for your distribution. The devel package because includes the files you need during development as opposed to runtime. -- John
participants (4)
-
Alan DeKok -
John Dennis -
Roberto Carna -
stefan.paetow＠diamond.ac.uk