Freeradius PEAP/MSCHAPv2 against Apple OpenDirectory
moenster at hotmail.de
Fri Feb 12 15:35:11 CET 2010
I got a
machine up and running Freeradius 2.1.0 with SSL support to secure a Wireless
LAN. In our school’s network we (have to) use an Apple Mac OS X 10.4 Server
with Samba as the PDC. Samba stores the user information using the
OpenDirectory on the same server – using the NTLM password hashes… so far,
there should be no problem for Freeradius using LDAP to connect to the OD an
retrieve the NTLM hash to authenticate the wireless clients.
Apple version of Samba/OD doesn’t store the password hashes in a single
attribute like “ntPassword” but has an attribute authAuthority wherein I can
find the password hash along with other data.
It looks as
root at schulserver.intern:10.10.1.1
Is there a possibility of modifying the LDAP return value (e.g. by a regex) so
that I only get the hash? I’ve searched the web for over two weeks now, but
haven’t found an answer, that satisfies me.
I know, I
also could use ntlm_auth for authentication, but as far as I can see, I
couldn’t select a user group to be granted access. Either all users that Samba
knows or none. Via LDAP/OP I could select a single group (e.g. named
“WirelessAccess”) that will be successfully granted access to the Wireless. Or
am I mistaken at that point?
would be greatly appreciated!
Windows 7 - Alles was Du brauchst und noch viel mehr!
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Freeradius-Users