On 03/01/12 12:26, Thorsten Scherf wrote:
Ok, I should be more precise. Let's try it again. Let's say I have a
FreeRadius server with LDAP backend. The LDAP backend contains user and
machine objects with RADIUS and POSIX specific attributes. I now want to
use that LDAP box to act as a backend for 802.1x access as well as
authentication server for logins based on pam_ldap.
With LDAP only I should have a PAM config like this:
...
auth sufficient pam_ldap.so ...
...
In a 802.1x I won't have network access before my local supplicant sends
proper login credentials to a NAS in order to get access to the network.
With my understanding, what would require another PAM module that is
called before pam_ldap. Something like this:
...
auth required pam_radius_auth.so ...
auth sufficient pam_ldap.so ...
...
IMHO, the pam_radius_auth is responsible to get proper network access
that would help pam_ldap to talk to the LDAP server in order to do a
"second level of authentication", in order to benefit from things like
password policy and things like that. Maybe I'm completely wrong here,
that's why I asked for some clarification.
I'm sorry, but you *are* completely wrong. You've misunderstood how PAM
works, and what pam_radius_auth does.
pam_radius_auth is "just like" pam_ldap - it checks login credentials
against a radius server, instead of an LDAP server.
pam_radius_auth DOES NOT perform 802.1x, or have anything to do with
network connectivity.
Currently, Linux systems do not integrate the 802.1x authentication with
the PAM login system. What you want to do can't be done.
The best you can do is either a)
1. Install NetworkManager
2. Create a user account per-machine
3. Define a system connection, using the per-machine account
4. Use that system connection for 802.1x, and pam_ldap for login
or b)
1. Use some kind of "cached" login to login before network is up e.g.
"sssd" or "pam_ccreds"
2. After login, use per-user 802.1x connections
Ideally, there would be a 3rd option, where a mythical PAM module
communicates the username/password to NetworkManager at login, waits for
NetworkManager to perform 802.1x, and then continues with pam_ldap and
similar - but that module does not exist.
the LDAP server. Question now is, how does this work when user foo logs
into his notebook by GDM or something similar?! The machine would have
to lookup the provided user crendentials on a LDAP server - that would
not work since no access to the network is possible at that time, thus
another action has to take place to authenticate using 802.1x.
As above - 802.1x and login authentication are not integrated on Linux.
What you want to do, can't be done currently.
And again, this is not really a FreeRADIUS question. You might want to
ask on the NetworkManager or PAM mailing list(s) whether there are any
plans to provide "single signon" 802.1x & login authentication.
Cheers,
Phil
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
