how to use LDAP for authorization and authentication while using EAP method!!!!!!
hello all, i have ldap server installed, i am using it to cross check user-name and password provided by the client!! now for doing this i have to configure my radius server for using LDAP for authorization and authentication. Now when i configure accordingly server cant understand any EAP method. But my client is windows which i am cant configure for methods other that eap, either i have to use ttls, peap, tls. now i configures it for PEAP while disabling verification of server certificate i cant dissable option of using MSCHAP for second phase of authetication. now here my server is not able to understand that that encrypted password. can anyone help me out with this, my server is working fine i tested it using radtest command from same local host. i just cant fix it, can u tell me what is the way out of this, what else can i do, i want to use those ldap accounts and passwords with this but not able to figure it out!! thanks and regards shantanu --------------------------------- 5, 50, 500, 5000. Store N number of mails in your inbox. Click here.
If I understand you well, passwords in LDAP are encrypted, so PEAP won't work. And you want to keep them that way. Your only option is to use SecureW2 and EAP-TTLS-PAP. Ivan Kalik Kalik Informatika ISP Dana 2/8/2007, "shantanu choudhary" <shantanu_843@yahoo.co.in> piše:
hello all, i have ldap server installed, i am using it to cross check user-name and password provided by the client!! now for doing this i have to configure my radius server for using LDAP for authorization and authentication. Now when i configure accordingly server cant understand any EAP method. But my client is windows which i am cant configure for methods other that eap, either i have to use ttls, peap, tls. now i configures it for PEAP while disabling verification of server certificate i cant dissable option of using MSCHAP for second phase of authetication. now here my server is not able to understand that that encrypted password. can anyone help me out with this, my server is working fine i tested it using radtest command from same local host. i just cant fix it, can u tell me what is the way out of this, what else can i do, i want to use those ldap accounts and passwords with this but not able to figure it out!!
thanks and regards shantanu
--------------------------------- 5, 50, 500, 5000. Store N number of mails in your inbox. Click here.
<tnt@kalik.co.yu> writes:
> If I understand you well, passwords in LDAP are encrypted, so > PEAP won't work. And you want to keep them that way. Your only > option is to use SecureW2 and EAP-TTLS-PAP. Or do as I managed to get it working yesterday - put a Samba server in between. RADIUS -> Samba -> LDAP This means that RADIUS uses LDAP directly for _authorization_, but MSCHAP (ntlm_auth from samba) for _authentication_. Works great now that I managed to get Samba configured correctly (had some unstability problems). > Dana 2/8/2007, "shantanu choudhary" <shantanu_843@yahoo.co.in> > piše: >> hello all, i have ldap server installed, i am using it to cross >> check user-name and password provided by the client!!
so what changes we have to make so that it works as you have suggested?? --------------------------------- Once upon a time there was 1 GB storage in your inbox. Click here for happy ending.
If passwords in Ldap are encrypted in anything apart from NT hash, MSCHAP won't work. Only EAP that you can use is EAP-TTLS-PAP. For that you need to use SecureW2 as a suppicant on Windows PCs and configure ttls in eap.conf. I assume that you have configured tls since you have tried PEAP before. Ivan Kalik Kalik Informatika ISP Dana 5/8/2007, "shantanu choudhary" <shantanu_843@yahoo.co.in> piše:
so what changes we have to make so that it works as you have suggested??
--------------------------------- Once upon a time there was 1 GB storage in your inbox. Click here for happy ending.
well sorry for confusing... i was asking for changes so as to work in the way: RADIUS-->SAMBA-->LDAP so that it can work for those EAP passwords!!!! thanx for your support and suggestion regards shantanu --------------------------------- Once upon a time there was 1 GB storage in your inbox. Click here for happy ending.
What password encryption are you using? If it's not NT hash MSCHAP won't work with or without samba and ntlm_auth. Ivan Kalik Kalik Informatika iSP Dana 6/8/2007, "shantanu choudhary" <shantanu_843@yahoo.co.in> piše:
well sorry for confusing... i was asking for changes so as to work in the way: RADIUS-->SAMBA-->LDAP so that it can work for those EAP passwords!!!! thanx for your support and suggestion regards shantanu
--------------------------------- Once upon a time there was 1 GB storage in your inbox. Click here for happy ending.
so what changes we have to make so that it works as you have suggested?? --------------------------------- Why delete messages? Unlimited storage is just a click away.
Install SecureW2 on Windows PCs and set it to use EAP-TTLS-PAP. Enable ttls and change default eap protocol to pap (in ttls section). Ivan Kalik Kalik Informatika ISP Dana 6/8/2007, "shantanu choudhary" <shantanu_843@yahoo.co.in> piše:
so what changes we have to make so that it works as you have suggested??
--------------------------------- Why delete messages? Unlimited storage is just a click away.
participants (3)
-
shantanu choudhary -
tnt＠kalik.co.yu -
Turbo Fredriksson