darkblue wrote:
There two type of method to integrate freeradius with AD, ntlm_auth
and ldap, with help by experts such as Alan DeKok and Nicolas
Baradakis , I had been setup the 802.1x+freeradius+ntlm_auth+AD. and I
wonder what are the advantage and disadvantage about ldap and
ntlm_auth.LDAP sounds better than ntlm_auth, is that right?
They're totally different. You are unlikely to find LDAP against AD
useful for 802.1x authentication.
LDAP-the-protocol can do two things:
1. What it's supposed to - return *information*. This can include,
subject to access control, user info, such as the plaintext password
*or* various pre-crypted ones such as the NT or LM hashes, the digest
HA1, etc. This information is then available to FreeRadius to use, and
FreeRadius can then do all the authentication (using the plaintext or
appropriate crypts) and authorisation (using e.g. group info) itself
2. What it's not really supposed to but is used for A LOT; It can act
as an authentication server for PAP. You connect, optionally bind as a
search user, search to find the user, then (re)bind using the username
and plaintext password from the PAP request, getting an OK or failed. In
this scenario, you're effectively proxying Radius+PAP to LDAP+SimpleBind
Now, ActiveDirectory cannot be made to return any password hash
information over LDAP. It cannot, as far as anyone knows, be done.
Therefore, if you're talking to AD over LDAP, you CANNOT extract the NT
or LM hashes (or for that matter, the Kerberos DES/3DES/AES keys, or
even the plaintext password if you're using reversible encryption).
Therefore, LDAP to AD can ONLY authenticate PAP requests.
MS-CHAP requests can be authenticated via the "ntlm_auth" helper method.
The ONLY other way of doing MS-CHAP is to have the NT or LM hash in a
form you can get into the radius server. This is by design nearly
impossible to do with AD.
(This excludes such obvious methods as using a password change plugin to
capture passwords and make a copy of the NT/LM hashes or even plaintext,
and various similar things, but they're orthogonal to the discussion)
This is such an FAQ I wonder if it should be added to the default config
file above the LDAP module.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
