Authorize with SQL and not authenticate
Hi people, I've just have a default file with a LDAP + SQL queries for user authorization, and NTLM for user authentication. Also I want to just authorize hosts sending its MAC Addresses as its usernames according to a SQL query matching a Mac Address table, but I don't want to authenticate them because the Active Directory doesn't contain MAC Addresses as usernames. Is it possible just authorize with Freeradius and so let hosts to access the LAN network ? Thanks a lot!!!
On Jul 4, 2018, at 11:45 AM, Tom Yard <tomyyard@gmail.com> wrote:
I've just have a default file with a LDAP + SQL queries for user authorization, and NTLM for user authentication.
Also I want to just authorize hosts sending its MAC Addresses as its usernames according to a SQL query matching a Mac Address table, but I don't want to authenticate them because the Active Directory doesn't contain MAC Addresses as usernames.
Sure. But only if the user is doing PAP. It won't work for MS-CHAP, because each end authenticates the other. And both ends need the password.
Is it possible just authorize with Freeradius and so let hosts to access the LAN network ?
Yes. The question then is, what do MAC auth packets look like? Alan DeKok.
Dear Alan, thanks for your response. Now I have NTLM _AUTH with MSCHAP in Freeradius, and I can see I have enabled PAP autheentication and authorization too (in default and inner-tunnel files). Please can you tell me where I have to force PAP from the user side in ordr to just authorize the hosts? Users are logged into a host and after that the switch sends the MAC Address' host to the Freeradius server. Thanks again!!! 2018-07-04 12:47 GMT-03:00 Alan DeKok <aland@deployingradius.com>:
On Jul 4, 2018, at 11:45 AM, Tom Yard <tomyyard@gmail.com> wrote:
I've just have a default file with a LDAP + SQL queries for user authorization, and NTLM for user authentication.
Also I want to just authorize hosts sending its MAC Addresses as its usernames according to a SQL query matching a Mac Address table, but I don't want to authenticate them because the Active Directory doesn't contain MAC Addresses as usernames.
Sure. But only if the user is doing PAP. It won't work for MS-CHAP, because each end authenticates the other. And both ends need the password.
Is it possible just authorize with Freeradius and so let hosts to access the LAN network ?
Yes.
The question then is, what do MAC auth packets look like?
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
On Jul 4, 2018, at 12:22 PM, Tom Yard <tomyyard@gmail.com> wrote:
Now I have NTLM _AUTH with MSCHAP in Freeradius, and I can see I have enabled PAP autheentication and authorization too (in default and inner-tunnel files).
That's enabled in the default config.
Please can you tell me where I have to force PAP from the user side
Configure the user side. There is *no* negotiation of PAP vs MS-CHAP in RADIUS.
in ordr to just authorize the hosts? Users are logged into a host and after that the switch sends the MAC Address' host to the Freeradius server.
Configure the switch to do MAC address authentication. See the switch documentation for details. Alan DeKok.
participants (2)
-
Alan DeKok -
Tom Yard