Re: freeradius with samba domain and port-access (Christian)
Christian Hohmann wrote:
Now the Problem: Some workstations are added to a samba managed domain and can only login on the samba service. It seems to me, that the winxpsp2 supplicant first wants to authenticate at the samba server. But the switch doesn?t allow the connection, because the port is closed until the eap-authentication is handled.
The machines also need to log in using EAP. Alan DeKok.
Thanks for help. I think so too, but I have no idea how or even if it is possible. The WXPSP2 Client with user authentication is not able to authanticate against the freeradius. There is not even a request arriving on the freeradius. If I toggle to "Identify with ComputerInformation if possible" there is at least a request arriving at the radiusserver. It takes some time, but it works. After the Authentication with computer Information, its not possible to authenticate a second time with the user information. How do i have to configure the client correctly to realize userauthentication? Or do I need to reconfigure the server? Regards - Christian _______________________________________________________________ SMS schreiben mit WEB.DE FreeMail - einfach, schnell und kostenguenstig. Jetzt gleich testen! http://f.web.de/?mc=021192
The Windows clients can be configured to log on with machine credentials. For this, they will need accounts in AD. This has been tested to work with FreeRADIUS for a while. I haven't done it myself, but search the net & docs. It does work. Once that happens, the switch thinks that the machine is authenticated, and may not re-do authentication for the user. There's very little you can do in this case. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
"Thanks for help. I think so too, but I have no idea how or even if it is possible. The WXPSP2 Client with user authentication is not able to authanticate against the freeradius. There is not even a request arriving on the freeradius. If I toggle to "Identify with ComputerInformation if possible" there is at least a request arriving at the radiusserver. It takes some time, but it works. After the Authentication with computer Information, its not possible to authenticate a second time with the user information. How do i have to configure the client correctly to realize userauthentication? Or do I need to reconfigure the server?" I know it sounds stupid, but you have set up the correct radius type for port based authentication ? There's two on the HP procurves, Radius-CHAP Radius-EAP Do show authentication Via the CLI and it should give you something looking like this. * *Status and Counters - Authentication Information Login Attempts : 3 Respect Privilege : Enabled | Login Login Enable Enable Access Task | Primary Secondary Primary Secondary ----------- + ---------- ---------- ---------- ---------- Console | Radius Local Radius Local Telnet | Local None Local None Port-Access | EapRadius Webui | Local None Local None SSH | Radius Local Radius Local Web-Auth | ChapRadius MAC-Auth | ChapRadius Need to make sure Port-Access is set to EapRadius, else the switch won't pass the eap messages through correctly. If it's on Chap use config aaa authentication port-access eap-radius write mem --- Arran
participants (3)
-
Alan DeKok -
Arran Cudbard-Bell -
Christian Hohmann