IPA 4.5 with radius server

Hi :

Anyone has exp to use freeipa 4.0 above as radius server ? e.g want wifi
use radius everyone carry ldap password.
How to implement ? need special plugin ? seem it need new
attribute can generate harsh password and syn with LDAP together ?

Thx and Regards

Barry

[Aljaž Srebrnič]

>  On 6 Feb 2018, at 10:16, barrykfl--- via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org
> <mailto:[e-mail]>> wrote:
>  
>  Hi :
>  
>  Anyone has exp to use freeipa 4.0 above as radius server ? e.g want wifi
>  use radius everyone carry ldap password.
>  How to implement ? need special plugin ? seem it need new
>  attribute can generate harsh password and syn with LDAP together ? 
Hello Barry!
Yes, I’ve successfully set up RADIUS integration with MSCHAPv2, following these two blog
posts:

-
http://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_t...
<http://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_t...
- http://firstyear.id.au/blog/html/2016/01/13/FreeRADIUS:_Using_mschapv2_wi...
<http://firstyear.id.au/blog/html/2016/01/13/FreeRADIUS:_Using_mschapv2_wi...

I’ve enhanced my setup a little by using a kerberos keytab instead of a password for the
RADIUS service. If you do that, don’t forget to add the keytab to the GSSProxy
configuration for it to be renewed automatically.

--
Aljaž Srebrnič a.k.a g5pw
My public key:  https://g5pw.me/key <https://g5pw.me/key>
Key fingerprint = 2109 8131 60CA 01AF 75EC  01BF E140 E1EE A54E E677

[Giulio Casella]

I'm not sure I completely understand your needs, but I can try.
I use freeradius, on same host as freeipa.

Just configure freeradius to use ldap (usually in 
/etc/raddb/sites-enabled/default):

Auth-Type LDAP {
	ldap
}

Then configure ldap parameters (server, bind identity, bind password, 
base_dn) to suit your needs, usually in /etc/raddb/mods-enabled/ldap.


HTH

Cheers,
Giulio

>  On 6 Feb 2018, at 10:16, barrykfl--- via FreeIPA-users 
>  <freeipa-users(a)lists.fedorahosted.org 
>  <mailto:[e-mail]>> wrote:
>
>  Hi :
>
>  Anyone has exp to use freeipa 4.0 above as radius server ? e.g want wifi
>  use radius everyone carry ldap password.
>  How to implement ? need special plugin ? seem it need new
>  attribute can generate harsh password and syn with LDAP together ?

I have some confuse in the following sample:

https://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_...

host.ipa.example.net.au   > if I have a cluster of ldap  should I only need
config install in one server only or two?

if two then I may need change another host to  host1.ipa.example.net.au
<http://host.ipa.example.net.au/>    host2.ipa.example.net.au
<http://host.ipa.example.net.au/>   etc

2018-02-06 17:47 GMT+08:00 Giulio Casella via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org&gt;:

>  I'm not sure I completely understand your needs, but I can try.
>  I use freeradius, on same host as freeipa.
>
>  Just configure freeradius to use ldap (usually in
>  /etc/raddb/sites-enabled/default):
>
>  Auth-Type LDAP {
>          ldap
>  }
>
>  Then configure ldap parameters (server, bind identity, bind password,
>  base_dn) to suit your needs, usually in /etc/raddb/mods-enabled/ldap.
>
>
>  HTH
>
>  Cheers,
>  Giulio
>
>  On 6 Feb 2018, at 10:16, barrykfl--- via FreeIPA-users <
> > freeipa-users(a)lists.fedorahosted.org <mailto:[e-mail]
> > dorahosted.org>> wrote:
> >
> > Hi :
> >
> > Anyone has exp to use freeipa 4.0 above as radius server ? e.g want wifi
> > use radius everyone carry ldap password.
> > How to implement ? need special plugin ? seem it need new
> > attribute can generate harsh password and syn with LDAP together ?
> >
>  _______________________________________________
>  FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
>  To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
>

[Aljaž Srebrnič]

>  On 8 Feb 2018, at 05:04, barrykfl--- via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org
> <mailto:[e-mail]>> wrote:
>  
>  I have some confuse in the following sample:
>  
>
> https://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_...
> <https://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_...
>  
>  host.ipa.example.net.au <http://host.ipa.example.net.au/>   > if I have a
> cluster of ldap  should I only need config install in one server only or two? 
In this case, you’re setting up the service account for your RADIUS server. If you only
have one RADIUS server, then only one account is necessary. The number of LDAP servers is
irrelevant for this step.

>  
>  if two then I may need change another host to  host1.ipa.example.net.au
> <http://host.ipa.example.net.au/>    host2.ipa.example.net.au
> <http://host.ipa.example.net.au/>   etc 
I’m not really sure what you mean, but pay attention to the host names in the LDAP user
string, you’ll need to change them to your domain.

I’m replying to your second email here: You seem to be confusing authentication *of the
RADIUS server* with authentication of your users *to* the RADIUS server.

In order for your users to authenticate using MSCHAPv2, you’ll need to access the
ipaNTHash attribute of that user on the LDAP server. That contains a hash of the user’s
password. Since the hashing algorithm is pretty weak, access to that attribute is
restricted by default. In order to access it, you’ll have to give the RADIUS service
permission to do so (that is what that blog post is all about).

So, your RADIUS server will have to authenticate to the LDAP server to retrieve the user’s
hash, and one way to do it is setting a password for the RADIUS service. (Another way
would be with Kerberos/GSSAPI)

So yeah, you’ll have to set up a password for your radius service.


--
Aljaž Srebrnič a.k.a g5pw
My public key:  https://g5pw.me/key <https://g5pw.me/key>
Key fingerprint = 2109 8131 60CA 01AF 75EC  01BF E140 E1EE A54E E677

any steps for IPA relate to keybros
or it is only can do in windows ad ?

2018年2月8日 下午4:38 於 "Aljaž Srebrnič" <a2piratesoft(a)gmail.com&gt; 寫道：

>  On 8 Feb 2018, at 05:04, barrykfl--- via FreeIPA-users <
>  freeipa-users(a)lists.fedorahosted.org&gt; wrote:
>
>  I have some confuse in the following sample:
>
>  https://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_
>  Giving_permissions_to_service_accounts..html
>
>  host.ipa.example.net.au   > if I have a cluster of ldap  should I only
>  need config install in one server only or two?
>
>
>  In this case, you’re setting up the service account for your RADIUS
>  server. If you only have one RADIUS server, then only one account is
>  necessary. The number of LDAP servers is irrelevant for this step.
>
>
>  if two then I may need change another host to  host1.ipa.example.net.au
>  <http://host.ipa.example.net.au/>    host2.ipa.example.net.au
>  <http://host.ipa.example.net.au/>   etc
>
>
>  I’m not really sure what you mean, but pay attention to the host names in
>  the LDAP user string, you’ll need to change them to your domain.
>
>  I’m replying to your second email here: You seem to be confusing
>  authentication *of the RADIUS server* with authentication of your users
>  *to* the RADIUS server.
>
>  In order for your users to authenticate using MSCHAPv2, you’ll need to
>  access the ipaNTHash attribute of that user on the LDAP server. That
>  contains a hash of the user’s password. Since the hashing algorithm is
>  pretty weak, access to that attribute is restricted by default. In order to
>  access it, you’ll have to give the RADIUS service permission to do so (that
>  is what that blog post is all about).
>
>  So, your RADIUS server will have to authenticate to the LDAP server to
>  retrieve the user’s hash, and one way to do it is setting a password for
>  the RADIUS service. (Another way would be with Kerberos/GSSAPI)
>
>  So yeah, you’ll have to set up a password for your radius service.
>
>
>  --
>  Aljaž Srebrnič a.k.a g5pw
>  My public key:  https://g5pw.me/key
>  Key fingerprint = 2109 8131 60CA 01AF 75EC  01BF E140 E1EE A54E E677
>
>
>

[Aljaž Srebrnič]

>  On 8 Feb 2018, at 09:43, barrykfl(a)gmail.com
> <mailto:[e-mail]> wrote:
>  
>  any steps for IPA relate to keybros 
>  or it is only can do in windows ad ? 

I’m not really sure what you’re asking. Kerberos is a fundamental service of the FreeIPA
platform.

--
Aljaž Srebrnič a.k.a g5pw
My public key:  https://g5pw.me/key <https://g5pw.me/key>
Key fingerprint = 2109 8131 60CA 01AF 75EC  01BF E140 E1EE A54E E677