hi: i try to setup wireless wpa + freeradius. i use eap-peap-mschapv2, and it was success. i can authenticate users via "users" file and i can authenticate users via winbind+windows 2000 ad server. the next step i want to do is mix both "users" and "windows 2000 ad" as authentication source, but i don't know how to do it. i try to create two "mschap" modules, "mschap-1" and "mschap-2". but i found that the "mschapv2" module internally look at the module named "mschap", so the two modules i create are useless. can i creat a redundant moudle name "mschap" which include two mschap modules? or is there better way doing this? thanks for help!!! Best Regards, tbsky
tbsky@annsky.us wrote:
i use eap-peap-mschapv2, and it was success. i can authenticate users via "users" file and i can authenticate users via winbind+windows 2000 ad server. the next step i want to do is mix both "users" and "windows 2000 ad" as authentication source, but i don't know how to do it.
What do you mean "mix" the two?
i try to create two "mschap" modules, "mschap-1" and "mschap-2". but i found that the "mschapv2" module internally look at the module named "mschap", so the two modules i create are useless.
You're also not saying *why* you created two modules, or how creating two modules would help. Alan DeKok.
tbsky@annsky.us wrote:
i use eap-peap-mschapv2, and it was success. i can authenticate users via "users" file and i can authenticate users via winbind+windows 2000 ad server. the next step i want to do is mix both "users" and "windows 2000 ad" as authentication source, but i don't know how to do it.
What do you mean "mix" the two?
sorry i didn't clearify my question. mix the source means if windows wireless client enter a peap username and password, freeradius would first check windows domain via "ntlm_auth" program, if that fails, check the "users" file. any of them suceess, freeradius would give Access-accept.
i try to create two "mschap" modules, "mschap-1" and "mschap-2". but i found that the "mschapv2" module internally look at the module named "mschap", so the two modules i create are useless.
You're also not saying *why* you created two modules, or how creating two modules would help.
sorry again. i create two modules because i want to create a "redudant module" like the "sql1" and "sql2" example in freeradius "configurable_failover" document. but i found that i can not tell "mschapv2" module to use them, since "mschapv2" want only "mschap" internally. in my first thought, i create two "mschap" modules. mschap-1 use "ntlm_auth" to authenticate user. mschap-2 use "users" file to authenticate user. now if i can tell freeradius "mschapv2" to use the "mschap-1" and "mschap-2" as failover redudant, then i can solve my problem. but i don't know how to do. thanks a lot for ur help!!! Best Regards, sky_li
tbsky@annsky.us wrote:
sorry i didn't clearify my question. mix the source means if windows wireless client enter a peap username and password, freeradius would first check windows domain via "ntlm_auth" program, if that fails, check the "users" file. any of them suceess, freeradius would give Access-accept.
The "ntlm_auth" program runs in the "authenticate" section, and the "users" file runs before that, in the "authorize" section. What you want to do is impossible in the current implementation. Can you describe what you want to do, WITHOUT getting into implementation details? There may be other ways of acheiving your goal, which you're not seeing. If all you talk about is implementation, we have no way of helping you find those other solutions. Alan DeKok.
Hi: thanks for ur reply. let me describe my need and plan. i want to use freeradius as our wireless authenticator. client is windows xp and using wpa + eap-peap-mschapv2. wireless AP is configure to ask freeradius server. all employee in our company has windows domain account, so i want freeradius to ask windows for these guys via "ntlm_auth". guests didn't have windows domain account, so i want to create guest account in the "users" file, since it's a plain text file, i can easily write a web front-end to maintain that file. if freeradius can use both "ntlm_auth" and "users" file to authticate users, then everything is streight-forward. maybe there are some trinks can do what i want? thanks for ur help!! Best Regareds, sky_li
tbsky@annsky.us wrote:
sorry i didn't clearify my question. mix the source means if windows wireless client enter a peap username and password, freeradius would first check windows domain via "ntlm_auth" program, if that fails, check the "users" file. any of them suceess, freeradius would give Access-accept.
The "ntlm_auth" program runs in the "authenticate" section, and the "users" file runs before that, in the "authorize" section.
What you want to do is impossible in the current implementation.
Can you describe what you want to do, WITHOUT getting into implementation details? There may be other ways of acheiving your goal, which you're not seeing. If all you talk about is implementation, we have no way of helping you find those other solutions.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
tbsky@annsky.us schrieb:
if freeradius can use both "ntlm_auth" and "users" file to authticate users, then everything is streight-forward.
I suppose, you could simply try it the other way round, i.e. those users that get authenticated by the users file are done and those that aren't get a default rule to use ntlm_auth. Don't ask me for the details, though, I never used ntlm_auth myself... Regards, Stefan
tbsky@annsky.us wrote:
if freeradius can use both "ntlm_auth" and "users" file to authticate users, then everything is streight-forward.
For guests, put the following in the "users" file: name User-Password := "password", Use-NTLM-Auth := No And set up ntlm_auth for employees. It will work. Alan DeKok.
hi: that's what i want. thanks a lot for your kindly help. and thanks for Stefan, i think you want to tell me the same thing. Best regards, tbsky
tbsky@annsky.us wrote:
if freeradius can use both "ntlm_auth" and "users" file to authticate users, then everything is streight-forward.
For guests, put the following in the "users" file:
name User-Password := "password", Use-NTLM-Auth := No
And set up ntlm_auth for employees. It will work.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
Stefan.Neis＠t-online.de -
tbsky＠annsky.us